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ABSTRACT 


■  \ 

This  thesis  provides  a  review  and  evaluation  of  the 
Navy's  implementation  of  the  Federal  Managers'  Financial 
Integrity  Act.  Topics  considered  include:  internal  control 
in  the  Federal  Government;  overview  of  the  internal  control 
evaluation  system;  the  Department  of  the  Navy's  internal 
control  program  including  Navy  implementation  problems;  and 
Navy  solutions  and  shortcomings  to  the  implementation 
problems.  The  research  consisted  of  interviews  with  Naval 
activities  on  implementation  problems  and  solutions  and  a 
review  of  relevant  General  Accounting  Office  audits  and 
other  relevant  instructions  and  studies. 

The  conclusion  was  reached  that  the  Navy  has  made  fair 
progress  in  implementing  the  Act  but  further  action  is 
required.  Recommended  actions  include  increasing  Navy 
efforts  to  incorporate  the  internal  control  process  into  the 
overall  management  process,  reducing  the  paperwork  burden 
and  gaining  line  manager  support  of  the  process  in  order  to 
evolve  the  Navy's  system  into  a  more  effective  program. 
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I .  INTRODUCTION 


A.  PURPOSE 

The  Federal  Managers'  Financial  Integrity  Act  of  1982 
(FMFIA)  requires  department  and  agency  managers  to  identify 
internal  control  and  accounting  system  weaknesses  that  can 
lead  to  fraud,  waste  and  abuse  in  government  operations.  The 
issue  of  implementing  an  effective  internal  control  program 
in  the  Navy  is  very  important.  With  increasing  public 
scrutiny  over  the  misuse  of  government  assets,  Navy  managers 
will  need  to  become  more  concerned  with  obtaining  and 
utilizing  resources  effectively  and  efficiently  in 
accomplishing  their  objectives.  One  means  to  achieving  these 
objectives  is  an  effective  internal  control  program.  The 
FMFIA  provides  an  important  impetus  to  restoring  public 
confidence  in  the  management  of  the  government.  In  its 
current  implementation  of  the  Act,  the  Navy  has  made  a 
concerted  effort  to  comply  with  the  Act's  spirit  and  letter, 
and  has  made  some  progress  in  greater  organ i zat i ona 1 

coverage  and  more  effective  internal  control  evaluations. 
Implementation  of  an  effective  internal  control  program  in 
the  Navy  to  meet  the  objectives  of  the  FMFIA  has  not  been 
smooth  sailing  for  the  Navy  and  other  federal  agencies  as 
they  have  encountered  numerous  implementation  problems.  The 
purpose  of  this  thesis  is  to  review  and  evaluate  the  Navy's 


Progress  in  implementing  the  FMFIA  including  discussion  of 
past  implementation  problems  and  to  identify  areas  for 
improvement  that  managers  can  use  to  help  them  with  the 
internal  control  process. 

B.  BACKGROUND 

The  Budget  and  Accounting  Act  of  1950  required  the  head 
of  each  department  and  agency  to  establish  and  maintain 
adequate  systems  of  internal  control. 

With  growing  concern  over  numerous  publicized  cases  of 
government  mismanagement  of  resources.  Congress  amended  the 
Budget  and  Accounting  Act  via  the  FMFIA  to  require  ongoing 
evaluations  and  reports  on  the  adequacy  of  the  system  of 
internal  controls.  The  Act  further  requires  federal  managers 
to  correct  the  weaknesses  and  report  annually  to  the 
President  and  the  Congress  on  their  programs.  The  FMFIA  also 
required  the  Office  of  Management  and  Budget  (OMB)  to 
consult  with  the  Comptroller  General  of  the  United  States  to 
establish  guidelines  for  these  evaluations  and  reports. 
OMB  revised  the  already  established  government  policy  on 
internal  control  and  assigned  management  the  responsibility 
of  establishing,  maintaining,  reviewing  and  improving 
internal  control  systems  in  each  agency. 

Unfortunately,  the  Navy  has  experienced  implementation 
difficulties  with  the  FMFIA.  Some  of  the  implementation 
problems  encountered  by  the  Navy  include  initial  lack  of 


no  training  for  line 


guidance  from  the  headquarters  level, 
managers  on  how  to  perform  required  reviews,  significant 
resistance  from  line  managers  to  complete  required  reviews 
and  the  significant  amount  of  time  and  paperwork  burden 
associated  with  the  entire  management  control  review 
process  . 

C.  SCOPE  AND  METHODOLOGY 

The  objective  of  this  thesis  is  to  examine  and  evaluate 
the  Department  of  the  Navy's  progress  in  implementing  the 
Act.  The  history  and  evolution  of  internal  control  in  the 
Federal  Government  and  an  overview  of  the  current  internal 
control  evaluation  system  will  be  reviewed. 

This  thesis  then  presents  the  research  effort  by  first 
presenting  a  history  of  the  Navy's  internal  control  program, 
a  review  of  the  Navy's  financial  management  structure  and 
accounting  systems  weaknesses.  Then  the  problems  experienced 
by  the  Navy  in  implementing  an  effective  internal  control 
program  are  discussed.  This  is  followed  by  examining  the 
solutions  to  the  implementation  problems  as  well  as  the 
shortcomings  of  these  solutions. 


F i na 1 ly. 

the 

conclusion  is  reached  that 

there  are 

ways 

improve 

the 

process,  such  as  improving 

direction 

and 

coordination  in  the  Act's  implementation,  emphasizing 
alternatives  to  internal  control  reviews,  focusing  efforts 
on  high  risk  areas,  improving  management  training  and  using 
a  checklist  approach  to  completing  the  required  reviews. 
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The  research  consisted  of  telephone  Interviews  to 
solicit  any  innovative  ideas  to  improve  implementation  of 
the  Act.  In  addition,  a  detailed  search  and  evaluation  was 
made  of  the  literature  in  the  area  of  internal  control 
systems  and  the  GAO  audits  of  the  Navy's  progress  in 
implementation  of  the  Act. 

D.  ORGANIZATION  OF  THESIS  CHAPTERS 

Chapter  II  provides  a  discussion  on  the  background  of 
the  Federal  Government's  internal  control  system.  This 
includes  a  discussion  of  the  Budget  and  Accounting  Act  of 
1950,  OMB  Circular  A-123,  the  FMFIA,  and  the  GAO  standards 
for  internal  controls  in  the  Federal  Government. 

Chapter  III  examines  the  internal  control  evaluation 
system.  This  chapter  covers  the  DOD  internal  control 
evaluation  process,  including  performing  vulnerability 
assessments  and  management  control  reviews. 

Chapter  IV  details  the  history  of  the  Navy's  Internal 
Control  Program,  the  Navy's  financial  management  structure 
and  accounting  systems  weaknesses,  and  covers  the 
implementation  problems  the  Navy  has  experienced  in 
implementing  their  internal  control  program. 

Chapter  V  details  the  Navy's  implementation  problems 
solutions  and  the  shortcomings  of  those  solutions. 

Chapter  VI  provides  a  summary  along  with  some 
conclusions  about  and  recommendations  for  further 
implementation  of  the  FMFIA. 


II . -  INTERNAL  CONTROL  IN  THE  FEDERAL  GOVERNMENT 

A.  BUDGET  AND  ACCOUNTING  ACT  OP  1950 

The  Budget  and  Accounting  Act  was  passed  in  1950  and 
required  that  each  agency  head  establish  and  maintain 
systems  of  accounting  and  internal  control.  The  passage  of 
the  produced  high  expectations  that  these  systems  of 
accounting  and  internal  control  would  help  reduce  or  prevent 
fraud,  waste,  abuse  and  mismanagement  in  Federal  Government 
operations.  Unfortunately,  development  of  effective  systems 
has  been  slow  and  numerous  situations  continue  to  appear  in 
the  news  headlines  which  show  lack  of  fiscal  responsibility, 
such  as  instances  of  fraud,  waste  and  abuse  continue  to 
occur  at  unacceptable  levels. 

B.  OFFICE  OF  MANAGEMENT  AND  BUDGET  CIRCULAR  A-123 

One  reason  given  for  the  ineffectiveness  of  the  Budget 
and  Accounting  Act  was  its  lack  of  enforcement.  Although 
the  Act  was  understood  as  the  current  standards  of  internal 
standards  of  internal  control,  it  did  not  provide  specific 
guidance  on  internal  control  systems  or  require  mandatory 
reports  on  the  quality  of  those  systems. 

To  give  the  Act  more  teeth,  OMB  issued  Circular  A-123 
in  October  1981  as  an  early  effort  to  improve  controls.  The 
Circular  required  the  head  of  each  department  and  agency  to 
develop  and  maintain  adequate  systems  of  internal  control. 


Unlike  the  1950  Act,  however,  it  defined  requirements  and 
responsibilities  in  order  to  transform  the  1950  Act's 
expectations  and  enforcement  into  reality. 

The  purpose  of  A-123  is  to  prescribe  policies  and 
procedures  to  be  followed  by  executive  departments  and 
agencies  in  establishing,  maintaining,  evaluating, 
improving,  and  reporting  on  internal  controls  in  their 
program  and  administrative  activities  (ref.  l:p.l). 

Congress  also  saw  the  need  for  effective  internal 
management  in  the  Federal  Government.  The  pressure  for 
Congress  to  act  to  force  improvement  in  the  government 
agencies'  internal  management  was  fueled  by  the  numerous 
headlines  of  fraud,  waste  and  abuse  in  federal  activities 
and  programs,  eroding  public  conf idence,and  the  government's 
inability  to  operate  effectively.  Continuing  concern  over 
the  poor  condition  of  government  internal  control  and 
accounting  systems  led  the  Congress  to  pass  the  Federal 
Managers'  Financial  Integrity  Act  of  1982  (P.L.  97-255). 

C.  FEDERAL  MANAGERS'  FINANCIAL  INTEGRITY  ACT  OF  1982 

This  Act  requires  that  agency  heads  annually  report  to 

the  President  and  the  Congress  as  to  whether  their  internal 

accounting  and  administrative  control  systems  comply  with 

the  Comptroller  General's  internal  control  standards  and 

provide  reasonable  assurance  that: 

obligations  and  costs  are  in  compliance  with  applicable 
law; 
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funds,  property  and  other  assets  are  safeguarded;and 

—  revenues  and  expenditures  are  properly  recorded  and 
accounted  for  (ref.  2:p.2). 

The  Act  requires  that  each  agency  evaluate  its  internal 
control  system  in  accordance  with  guidelines  prescribed  by 
OMB  and  report  annually  any  material  internal  control 
weaknesses  together  with  plans  for  correction.  The  annual 
report  must  also  indicate  whether  or  not  the  agency's 
accounting  system  conforms  to  the  Comptroller  General's 
accounting  requirements. 

The  Act  directed  that  the  evaluation  and  reporting 
requirements  be  implemented  in  two  steps.  The  first  step 
was  the  preparation  of  guidelines  for  the  evaluation  of 
internal  and  administrative  controls  by  OMB  in  consultation 
with  the  Comptroller  General  by  December  31,1982.  The  second 
step  required  commencement  of  annual  reporting  by  the 
agencies  by  December  31,  1983. 

D.  STANDARDS  FOR  INTERNAL  CONTROLS  IN  THE  FEDERAL  GOVERMENT 

To  satisfy  the  first  step,  it  was  necessary  to  define 
what  was  meant  by  internal  control.  The  American  Institute 
of  Certified  Public  Accountants  (AICPA)  has  made  a 
distinction  between  internal  accounting  controls  and 
administrative  controls.  Administrative  controls  are 
concerned  with  the  decision  processes  leading  to 
management’s  authorization  of  transactions.  This 
authorization  is  the  starting  point  for  establishing 


internal  accounting  control  of  transactions.  Internal 
accounting  controls  are  concerned  with  safeguarding  of 
assets  and  reliability  of  financial  records.  Given 
the  AICPA  definitions  of  administrative  and  internal 
accounting  controls,  the  Federal  Government  needed  to 
develop  standards  for  internal  controls.  OMB  requested  GAO 
to  develop  these  standards.  GAO  reponded  by  publishing 
STANDARDS  FOR  INTERNAL  CONTROLS  IN  THE  FEDERAL  GOVERNMENT  in 
1983.  This  document,  which  has  come  to  be  known  as  the 
"green  book"  was  derived  from  the  professional  standards 
established  by  the  AICPA  and  includes  the  following  concept 
of  internal  controls  which  is  useful  in  understanding  and 
applying  the  internal  control  standards:  "The  plan  of 
organization  and  methods  and  procedures  adopted  by 
management  to  ensure  that  resource  use  is  consistent  with 
laws,  regulations  and  policies;  that  resources  are 
safeguarded  against  waste,  loss,  and  misuse;  and  that 
reliable  data  are  obtained,  maintained,  and  fairly  disclosed 
in  reports."  (ref.  3:p.l) 

What  is  an  internal  control  standard?  GAO  defines  it  as: 
"the  minimum  level  of  quality  acceptable  for  internal 
control  systems  in  operation  and  constitute  the  criteria 
against  which  systems  are  to  be  evaluated."  (ref.3:p.2)  The 
definition  adds  that  these  standards  apply  to  all  functional 
areas,  not  the  financial  or  accounting  areas.  Each  area 
has  some  inherent  internal  controls  in  the  form  of 
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instructions  mission  and  performance  requirements  and 
program  objectives. 

The  "green  book"  breaks  the  standards  for  internal 
control  into  three  areas:  general  standards,  specific 

standards,  and  the  audit  resolution  standard. 

1 .  General  Standards  of  Internal  Control 

GAO  lists  five  general  standards  of  internal 
control  which  apply  to  all  aspects  of  internal  controls, 
a.  Reasonable  Assurance 

"Internal  control  systems  are  to  provide 
reasonable  assurance  that  the  objectives  of  the  systems  will 
be  accompl ished . " ( re f . 3 : p . 4 )  The  term  "reasonable  assurance" 
is  inherently  subjective,  difficult  to  define  and  requires 
judgment  to  be  exercised.  The  concept  of  reasonable 
assurance  recognizes  that  internal  controls  must  be  cost- 
beneficial.  That  is,  the  cost  of  internal  control  should  not 
exceed  the  benefit  derived.  A  cost  here  refers  to  the 
financial  measure  of  resources  consumed  in  accomplishing  a 
specified  purpose.  The  benefit  derived  from  a  control  refers 
to  the  reduction  in  risk  from  failing  to  achieve  the 
objective  of  the  control.  Because  the  benefit  is  often  not 
precisely  quantifiable,  it  is  more  difficult  to  define  and 
determine,  and  decisions  must  depend  on  estimates  and 
judgments  by  management.  To  increase  the  amount  of  control 
in  an  area  usually  will  result  in  an  increase  in  cost. 
Therefore,  the  judgment  required  to  be  performed  with  each 


control  is  whether  the  cost  of  the  control  exceeds  the 
benefits  derived. 

b.  Supportive  Attitude 

"Managers  and  employees  are  to  maintain  and 
demonstrate  a  positive  and  supportive  attitude  toward 
internal  controls  at  all  times."  (ref.3:p.4)  Line  management 
commitment  to  achieving  effective  internal  controls  is  vital 
to  the  success  of  achieving  the  intent  of  this  standard. 
This  standard  requires  agency  managers  and  employees  to  be 
attentive  to  internal  control  matters  and  to  take  steps  to 
promote  the  effectiveness  of  the  controls.  The  bottom  line 
here  is  that  overall  leadership  is  critical  to  maintaining  a 
positive  and  supportive  attitude  toward  internal  controls. 
This  is  accomplished  through  training,  motivating  employees 
and  encouraging  management  improvement  suggestions. 

c.  Competent  Personnel 

"Managers  and  employees  are  to  have  personal 
and  professional  integrity  and  are  to  maintain  a  level  of 
competence  that  allows  them  to  accomplish  their  assigned 
duties,  as  well  as  understand  the  importance  of  developing 
and  implementing  good  internal  controls."  (ref.  3:p.5) 
Managers  and  their  staffs  are  required  to  maintain  and 
demonstrate  their  personal  and  professional  integrity,  a 
skill  level  necessary  to  ensure  effective  performance  and  a 
sufficient  understanding  of  internal  controls  to  effectively 
discharge  their  responsibilities.  Professional  integrity 
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can  be  promoted  or  strengthened  through  an  operative  code  of 


conduct.  In  addition,  staffing  decisions  should  include 
verification  of  minimum  education  and  skill  requirements. 
In  the  Federal  Government  this  is  a  severe 
limitation.  Therefore,  training  programs  are  required. 
Performance  appraisals  should  also  include  an  assessment  of 
the  manager's  implementation  and  maintenance  of  effective 
internal  controls.  Managers  who  possess  a  good 

understanding  of  internal  controls  are  vital  to  effective 
control  systems,  and  these  managers  should  be  used  in 
formal  and  on-the-job  training  programs, 
d.  Control  Objectives 

"Internal  Control  objectives  are  to  be 
identified  or  developed  for  each  agency  activity  and 
are  to  be  logical,  applicable,  and  reasonably  complete." 
(ref.3:p.6)  The  purpose  of  this  standard  is  that  the 
control  objectives  are  tailored  to  the  agency  for  each 
of  its  operations.  Usually,  all  operations  of  an  agency 
are  grouped  into  cycles  that  are  compatible  with  the 
agency's  division  of  responsibilities.  Some  agencies  collect 
cash,  others  do  not;  some  pay  out  cash;  some  are  more 

administrative  in  nature;  and  some  are  more  program  and  less 
financially  oriented.  Examples  of  cycles  include  financial, 
administrative,  agency  management  and  program  ( operat i ona 1 ) 
cycles.  These  cycles  interact  and  controls  over  their 
interaction  must  be  establ ished . To  comply  with  this 


standard, an  agency  must  identify  and  analyze  each  cycle  to 
determine,  the  internal  control  objectives.  These  objectives 
can  then  be  used  to  evaluate  the  agency's  internal  controls, 
e.  Control  Techniques 

"Internal  control  techniques  are  to  be 
effective  and  efficient  in  accomplishing  their  internal 
control  objectives."  (ref.3:p.7)  The  final  general  standard 
requires  that  the  techniques  of  control  are  effective  and 
efficient.  Internal  control  techniques  are  the  mechanisms  by 
which  control  objectives  are  achieved.  These  techniques  are 
policies,  procedures,  organizational  plans  and  physical 
layouts.  Control  techniques  must  insure  that  the  objective 
is  met  with  a  high  degree  of  assurance  within  cost 
limitations.  All  control  techniques  should  be  reviewed 
periodically  and  evaluated  as  to  their  effectiveness  and 
efficiency  and  be  modified  as  required.  Effectiveness  means 
that  the  techniques  fulfill  their  intended  purpose. 
Efficiency  means  that  the  techniques  are  designed  to  provide 
maximum  benefit  with  minimum  effort.  For  example,  adding 
more  personnel  to  the  internal  control  process  may  improve 
the  effectiveness  of  techniques  but  not  necessarily  the 
e  f  f ic lency . 

2 •  Spec i f ic  Standards  of  Internal  Control 

A  number  of  techniques  are  essential  to  providing 
the  greatest  assurance  that  the  internal  control  objectives 
are  achieved.  There  are  six  critical  specific  standards. 
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Documentation 


a . 

"Internal  control  systems  and  all  transactions 
and  other  significant  events  are  to  be  clearly  documented, 
and  the  documentation  is  to  be  readily  available  for 
examination."  (ref.3:p.8)  Basically,  this  standard  requires 
that  agencies  document  their  internal  control  objectives, 
techniques  and  accountability  systems  and  also  document  all 
pertinent  aspects  of  transactions  and  other  significant 
events  of  an  agency.  This  documentation  can  be  in  a  variety 
of  forms,  including  policy  manuals, management  directives  or 
flowcharts  of  transactions.  Complying  with  the  documentation 
standard  requires  that  the  documentation  of  internal  control 
systems  and  transactions  and  other  significant  events  be 
purposeful  and  useful  to  managers  in  controlling  their 
operations  and  also  provides  auditors  with  a  guide  for  their 
review. 

b.  Recording  of  Transactions  and  Events 

"Transactions  and  other  significant  events  are 

to  be  promptly  recorded  and  properly  classified." 
(ref.3:p.9)  This  standard  applies  to  the  entire  life 
cycle  of  a  transaction  and  includes  initiation  and 
authorization,  all  aspects  of  the  transaction  while  in 
process  and  its  final  classification  in  summary  records. 
This  standard  also  provides  management  with  the  information 
it  needs  to  control  operations  and  provides  summary  records 
from  which  reports  are  prepared  and  for  internal  review  and 
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audits.  Failure  to  adhere  to  this  standard  can  result  in  a 
loss  of  information  if  transactions  are  not  recorded  or  are 
misclass i f ied .  Also,  if  the  information  is  untimely  the 
agency's  reports  can  be  erroneous. 

c.  Execution  of  Transactions  and  Events 
"Transactions  and  other  significant  events  are 

to  be  authorized  and  executed  only  by  persons  acting  within 
the  scope  of  their  authority."  (ref.3:p.9)  The  purpose  of 
this  standard  is  to  assure  that  only  valid  transactions  and 
other  events  are  entered  into.  Organizations  must  have  clear 
lines  of  authority  for  certain  decisions  such  as  cash 
payments.  Independent  evidence  should  be  maintained  so  that 
proper  authorizations  are  issued  and  so  that  the 
transactions  conform  with  the  terms  of  the  authorizations. 
Authorization  must  be  clearly  understood  by  all  persons 
concerned  and  specific  conditions  of  authorization  must  bs 
clear  to  ensure  compliance  with  this  standard. 

d.  Separation  of  Duties 

"Key  duties  and  responsibilities  in 
authorizing,  processing,  recording,  and  reviewing 
transactions  should  be  separated  among  individuals." 
(ref.3:p.l0)  No  one  individual  should  control  all  key 
aspects  of  a  transaction  or  event.  The  primary  factor  for 
deciding  when  to  separate  duties  is  if  the  performance  ot 
duties  by  one  person  would  allow  that  person  to  commit  fraud 
or  abuse  the  system.  Duties  and  responsibilities  should  be 
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assigned  to  a  number  of  individuals  to  ensure  effective 
checks  and  balances  exist.  One  major  area  to  watch  in  this 
area  is  collusion,  because  collusion  can  reduce  or  destroy 
the  effectiveness  of  this  standard.  Unfortunately, col lus i on 
is  very  hard  to  discover  since  it  involves  two  or  more 
individuals. 

e.  Supervision 

"Qualified  and  continuous  supervision  is  to  be 
provided  to  ensure  that  internal  control  objectives  are 
achieved."  (ref.3:p.l0)  This  requires  supervisors  to 
continuously  monitor  the  work  of  their  employees  and  ensure 
they  receive  proper  training  and  direction.  The  assignment, 
review  and  approval  of  employees'  work  includes 
communicating  the  duties  and  responsibilities  clearly, 
periodic  review  of  performance  and  approval  of  work  at 
critical  points  to  ensure  timely  completion.  This  standard 
ties  together  internal  controls  and  can  prevent  weaknesses 
such  as  collusion  from  occurring.  Supervision  is  a  subset  of 
operational  control  and  is  generally  concerned  with  the  day 
to  day  operations  of  the  organization.  Mautz  and  White  say 
supervision  is  designed  to  provide  reasonable  assurance 
that  employees  utilize  and  conserve  the  activity’s 
resources  and  do  not  undertake  actions  detrimental  to  the 
accomplishment  of  stated  objectives  ( ref . 4 : p . 15 ) . The  process 
involves  managers  who  get  things  done  by  working  with 
others  instead  of  continuously  monitoring  personnel  actions. 
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Access  to  and  Accountab i 1 i ty  foe  Resources 


"  Access  to  resources  and  records  is  to  be 


limited  to  authorized  individuals,  and  accountability  for 


the  custody  and  use  of  resources  is  to  be  assigned  and 


maintained.  Periodic  comparison  shall  be  made  of  the 


resources  with  the  recorded  accountab i 1 i ty  to  determine 


whether  the  two  agree.  The  frequency  of  the  comparison 


shall  be  a  function  of  the  vulnerability  of  the  asset." 


ref.3:p.ll)  The  basic  concept  behind  this  standard  is  to 


restrict  access  to  resources.  This  will  help  reduce  the 


risk  of  fraud,  waste  or  abuse  of  assets.  Some  assets, ( e . g . , 


cash  and  pilferable  material)  are  more  vulnerable  to  fraud. 


waste  or  abuse  than  others.  This  is  because  of  factors  such 


as  cost,  portability,  exchangeability,  and  the  perceived 


risk  of  loss  or  improper  use  of  the  resources.  Each  agency 


must  evaluate  its  resources  and  establish  .control 


commensurate  with  these  factors  that  provide  reasonable 


assurance  that  these  resources  are  safeguarded. 


3 .  Audit  Resolution  Standard 


a.  Prompt  resolution  of  audit  findings 


"Managers  are  to  promptly  evaluate  findings  and 


recommendations  reported  by  auditors,  determine  proper 


actions  in  response  to  audit  findings  and  recommendations. 


and  complete,  within  established  timeframes,  all  actions 


that  correct  or  otherwise  resolve  the  matters  brought  to 


management's  attention."  (ref.3:p.l2) 


raw 


The  process  of  resolving  audit  findings  begins  when 
the  audit  results  are  presented  to  management  and  is 
completed  when  actions  have  been  taken  to  correct  the 
identifed  deficiencies,  produce  improvements  or  demonstrate 
the  audit  findings  are  either  invalid  or  do  not  warrant 
management  action. 

E.  CONCLUSION 

The  implementation  of  the  Federal  Managers'  Financial 
Integrity  Act,  OMB  Circular  A-123  and  the  GAO  Standards  for 
Internal  Controls  in  the  Federal  Government  has  been 
progressing,  although  not  as  quickly  as  was  expected. 
However, the  requirement  for  implementation  and  evaluation  of 
these  controls  is  real. 

The  standards  for  internal  control  must  be  understood 
by  the  personnel  implementing  and  evaluating  these  systems. 
Nevertheless,  these  are  broad  guidelines  which  management 
must  tailor  to  meet  its  own  specific  organization. 

Based  on  our  discussion  of  the  standards  of  internal 
in  the  Federal  Government,  we  will  next  discuss  the  system 
of  internal  control  evaluation  the  Navy  is  using  to 
implement  the  Federal  Managers'  Financial  Integrity  Act  of 
1982  and  to  comply  with  the  requirements  of  the  Act. 


III. OVERVIEW  OF  THE  INTERNAL  CONTROL  EVALUATION  SYSTEM 


A.  INTRODUCTION 


Once  Congress  passed  the  Federal  Managers'  Financial 
Integrity  Act  of  1982, it  became  a  requirement  for  each 
agency  to  conduct  evaluations  of  their  systems  of  internal 
control.  OMB  developed  and  revised  Circular  A-123  to  issue 
guidelines  for  the  evaluation  of  internal  controls.  These 
guidelines  have  been  expanded  to  include  not  only  accounting 
controls  but  also  administrative  controls. 

Accounting  controls  safeguard  assets  and  assure 
reliability  of  the  financial  records.  Accounting  controls 


in  one  form  or  another  are  also  employed  in  other 
nonfinancial  functions  (e.g.,  supply,  personnel  and  property 
management).  Administrative  controls  provide  the 
organizational  structure,  policies  and  procedures  through 
which  goals  and  missions  are  achieved  and  coordination  is 
maintained.  They  are  designed  to  assure  adherence  to 
applicable  regulations  and  policies.  The  Department  of 
Defense  (DOD)  and  the  Department  of  the  Navy  have  used  the 
OMB  guidance  in  developing  the  system  currently  used  to 
evaluate  internal  controls  in  their  agencies. 

The  entire  internal  control  evaluation  process  must  be 
understood  before  one  can  do  evaluations  and  analyze  the 
results.  An  eight  element  internal  management  control 
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program  must  be  developed  by  each  DOD  component  in 
accordance  with  DOD  Directive  5010. 38A  (re£.5:p.4).  The 

eight  elements  are: 

1.  Organizing  the  internal  management  control  process 

2.  Segmenting  the  components  into  assessable  units 

3.  Conducting  vulnerabilty  assessments  on  those  units 

4.  Developing  plans  for  subsequent  action 

5.  Conducting  internal  management  control  reviews  or 
other  appropriate  management  actions 

6.  Scheduling  and  taking  corrective  action 

7.  Providing  for  quality  control 

8.  Preparing  reports. 

This  chapter  will  focus  on  this  process. 

B.  ORGANIZING  THE  PROCESS 

One  of  the  most  critical  aspects  of  the  entire  internal 
control  process  is  organizing  the  evaluation  process. 
Organizing  the  internal  management  control  process  includes 
assigning  responsibilities  and  providing  personnel  for 
planning,  directing,  and  controlling  the  program;  developing 
internal  reporting  and  tracking  capabilities;  maintaining 
documentation;  and  scheduling  evaluations.  This  organization 
effort  provides  the  framework  that  ensures  that  evaluation 
improvement  and  reporting  on  internal  controls  is  conducted 
efficiently  and  effectively. 
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The  head  o £  the  agency  is  required  to  submit  a 
statement  on  the  status  of  the  agency's  internal  controls. 
However,  the  preparation  of  this  statement  must  be  delegated 
down  to  senior  agency  officials  to  ensure  that  the  process 
of  evaluating  and  reporting  on  internal  controls  is  in 
accordance  with  promulgated  guidelines.  These  senior 
officials  are  charged  with  the  responsibility  to  provide  the 
agency  head  with  written  assurances  that  the  program  was 
carried  out  in  an  efficient  and  effective  manner. 

The  assignment  of  responsibilities  should  include 
one  senior  official  to  oversee  the  entire  process.  This 
senior  official  oversees  the  organizational  units  and  these 
in  turn  oversee  the  heads  of  individual  activities.  This 
process  should  be  organized  down  to  the  lowest  level  of 
responsibility  that  is  feasible  for  the  efficient  operation 
of  the  process. 

In  addition, the  Inspector  General,  internal  audit  or 
internal  review  personnel  can  be  of  great  help  in  the 
organizing  process  to  reduce  or  prevent  duplication  of 
effort . 

2 .  Providing  Personnel  for  the  Program 

It  is  essential  that  a  sufficient  level  of  staff 
support  and  resources  be  committed  to  the  process  for 
planning,  directing,  and  controlling.  It  is  highly  likely 
that  most  of  these  personnel  will  have  little  or  no 


experience  in  evaluating  internal  controls.  Therefore,  it  is 
essential  that,  if  the  process  is  to  be  successful,  some 
specific  measures  are  considered  such  as  orientation 
and  training,  supervision,  technical  assistance,  monitoring 
to  assure  the  reviews  are  performed  adequately,  and 
individual  appraisal  of  their  performance.  Personnel 
involved  in  the  process  should  be  advised  that  this  will  be 
a  factor  in  their  overall  performance  evaluation. 


3.  Developing  Internal  Reporting  and  Tracking 

Capabi I ities 

An  internal  reporting  and  tracking  system  must  be 
established  to  ensure  that  the  evaluation  process  is 
performed  in  a  timely  manner.  The  system  at  a  minimum 
should  include  reporting  and  tracking  of  vulnerability 
assessments,  internal  management  control  reviews  and,  most 
importantly,  corrective  actions  to  be  taken  on  a  timely 
basis.  The  system  should  also  be  able  to  provide  information 
to  support  preparation  of  the  agency's  required  annual 
statement  and  the  gathering  of  information  on  actions 
necessary  to  improve  internal  controls. 

4 .  Maintaining  Documentat ion 

Adequate  documentation  must  be  maintained.  All 
documentation  connected  with  the  process  of  conducting 
vulnerability  assessments,  internal  management  control 
reviews  and  follow-up  action  should  be  kept  to  provide  a 


record  on  what  was  done  and  who  performed  the  duties.  This 
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information  will  also  be  valuable  for  reviewing  the  validity 
of  conclusions  reached,  evaluation  of  performance  of 
individuals  performing  the  reviews  and  an  audit  trail  for 
future  assessments. 

5 .  Scheduling  Evaluat  ions 

The  scheduling  of  evaluations  is  driven  by  the 
Circular  A-123  requirements.  The  process  should  be  scheduled 
to  insure  that  all  reviews  are  completed  in  time  to  support 
the  preparation  of  the  agency's  annual  statement.  In 
completing  the  requirement,  items  such  as  the  cyclical 
nature  of  operations,  availability  of  personnel  and  resource 
availability  should  be  taken  into  account. 

C.  SEGMENTING  THE  AGENCY 

DOD  guidance  requires  that  inventories  of  assessable 
units  shall  be  established  by  segmenting  the  component  into 
organizational,  functional,  programmatic,  or  other 
appropriate  subdivisions  suitable  for  evaluating  systems  of 
internal  management  controls,  and  identifying  program  and 
administrative  activities  of  appropriate  nature  and  size  to 
facilitate  a  meaningful  assessment.  The  resulting  listing  of 
assessable  units  shall  be  reviewed  annually  for  changes. 

In  developing  the  listing  of  assessable  units, 
reference  should  be  made  to  sources  of  information  such  as 
organization  charts,  procedure  manuals,  the  agency's  budget 
and  program  management  information  systems. 
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Two  important  factors  should  be  considered  when 
segmenting  the  agency.  First,  the  segmentation  should 
include  the  lowest  level  of  responsibility  feasible.  Second, 
segmentation  of  the  agency  must  provide  for  the  systematic 
evaluation  and  reporting  of  internal  control  systems. 

D.  CONDUCTING  VULNERABILITY  ASSESSMENTS 

A  vulnerability  assessment  is  a  review  of  the 
susceptibility  of  all  the  programs  listed  in  the 
segmentation  process  to  the  occurrence  of  waste,  loss, 
unauthorized  use  or  mi sappr opr iat i on .  The  vulnerability 
assessments  do  not  identify  or  evaluate  the  effectiveness 
of  internal  controls;  they  only  establish  the  potential  for 
loss  . 

Each  agency  conducts  its  own  vulnerability 
assessments.  They  are  performed  by  all  levels  of  management 
including  the  lowest  possible  responsible  level  as 
determined  by  the  segmentation  process. 

The  vulnerability  assessment  consists  of  three 
steps:  (1)  analysis  of  the  general  control  environment,  (2) 
analysis  of  inherent  risk,  and  (3)  preliminary  evaluation  of 
safeguards.  Completion  of  these  three  steps  is  then 
summarized,  allowing  the  assessor  to  make  an  overall 
assessment  of  the  units.  The  three  steps  of  a  vulnerability 
assessment  will  be  covered  below. 


1.  Anal ys is  ot  the  General  Control  Env i r onment 


The  environment  of  an  activity  has  a  major  influence 
on  the  vulnerability  of  a  program.  There  are  several  factors 

which  influence  the  environment,  including: 


-  Management  At t i t ude-  Management  recognition  ot  the 
importance  of  and  coirim  i  tine  n  t  to  the  establishment 
and  maintenance  of  a  strong  system  of  internal  control 
as  communicated  to  employees  through  actions  and  words. 


-  Organizational  Structure-  The  identification  of 
organizat ional  units  to  perform  the  necessary  functions 
and  the  establishment  of  appropriate  reporting 

relationships . 


Personnel  -  The  competence 

organization's  personnel. 


and  integrity  of  the 


Dcleqat ion  and  Commun i cat  1  on  o  f  Author i t v  and 
Respons ibi  1 i ty-  Appropriate  delegation  or  limitation  of 
authority  in  a  manner  that  provides  assurance  that 
responsibilities  are  effectively  discharged. 


-  Policies  and  P r oced ures  The  definition,  documentation 

and  dissemination  of  information  to  ail  employees  as 
to  how  the  organization  is  intended  to  perform  in 

various  situations. 


Budgeting  and  Repor  ting  Practices-  Tne  spec i f i ca t i on 
and  commun l ca t i on  of  organizational  goals  and  the 
extent  of  their  accompi ishment . 


or  gan  izat ional  Checks  and  Balances-  The  establishment 
of  an  appropriate  level  of  financial  and  other 
management  controls  and  internal  auditing. 


Automated  Data  Process  inu  ( ADP )  Cons ider at l on  -  When 
utilized,  an  swsreness  of  the  strengths  and  exposures 
innerent  in  a  system  that  uses  ADP  and  the  existence  of 
appropriate  controls. 


The  analysis  of  the  general  control  environment 
should  be  performed  throughout  the  agency.  It  is  the  first 
step  in  the  vulnerability  assessment  process.  The  analysis 
can  be  performed  either  as  a  whole  or  individually  for 


each 
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component.  It  should  be  performed  by  determining  whether  or 
not  the  cnaracter ist ics  of  a  strong  control  environment 
exists  by  reviewing  policies  and  procedures,  interviewing 


appropriate  management  personnel,  observing  daily  practices 
and  by  gaining  a  familiarity  with  the  operations. 

2 .  Anal vs  is  of  I nher ent  Risk 

The  second  step  in  the  vulnerability  assessment 
process  is  to  perform  an  analysis  of  the  inherent  potential 
risk  for  waste,  loss,  unauthorized  use  or  misappropriation 
due  to  the  nature  of  the  activity.  This  assessment  is 
performed  to  determine  those  programs  with  higher  risk  as 
those  programs  generally  require  more  control.  Some  factors 
to  be  considered  in  performing  this  analysis  are: 

-  Purpose  and  character ist ics  of  the  program 

-  Budget  level  allocated  to  the  program 

-  Impact  of  the  program  outside  the  agency 

-  Age  and  expected  life  of  the  program 

-  The  degree  of  centralization  of  the  program 

-  Special  concerns  of  the  program 

-  Prior  reviews  of  the  program 

-  Management  responsiveness  within  the  program 

3 .  Preliminary  Eva luat ion  o f  Sa f equar ds 

The  third  step  in  the  vulnerability  assessment 
process  is  the  making  of  a  preliminary  evaluation  by  the 
reviewer  on  the  existence  and  adequacy  of  internal  controls 
over  the  programs.  An  important  consideration  is  whet;,-: 
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adequate  controls  are  in  place  to  minimize  or  prevent 
waste,  loss  unauthorized  use, or  misappropriation.  This  is 
not  an  in-depth  review  of  internal  controls,  but  an 
assessmenmt  by  the  reviewer  of  the  existence  and  functioning 
of  current  controls. 

4.  Suwwar izinq  the  Results  of  the  Vulnerabi 1 1  tv 
Assessments 

After  completing  the  three  steps  of  the 
vulnerability  assessment  process, the  reviewer  can  summarize 
the  results  and  make  an  overall  assessment  of  the  adherence 
of  the  program's  internal  control  system  to  the  prescribed 
standards  and  the  vulnerability  of  the  program  to 
waste,  loss,  unauthorized  use,  or  misappropriation.  This 
information  allows  management  to  develop  a  plan  for 
conducting  the  internal  control  review  process. 

E.  CONDUCTING  INTERNAL  MANAGEMENT  CONTROL  REVIEWS 

Once  the  vulnerability  assessments  have  been  completed 
and  summarized,  plans  and  schedules  for  internal  management 
control  reviews  or  other  actions  shall  be  developed  based  on 
a  ranking  of  the  assessable  units'  vulnerability. 

An  internal  management  control  review  is  a  detailed 
examination  of  an  assessable  unit  to  ensure  internal 
controls  exist,  are  in  place,  documented  and  functioning  as 
intended.  These  in-depth  reviews  should  identify  weak,  non¬ 
existent  or  excessive  controls  and  initiate  actions 
necessary  to  correct  them. 
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Internal  management  control  reviews  shall  include  the 


following  six  steps: 

1.  Identification  of  event  cycles 

2.  Analysis  of  the  general  control  environment 

3.  Documentation  of  the  event  cycles 

4.  Evaluation  of  internal  controls  within  the  event  cycles 

5.  Testing  the  internal  controls 

6.  Reporting  the  results. 

1 .  Ident i f icat i on  of  Event  Cycles 

The  first  step  of  this  process  breaks  down  each 
program  into  their  respective  event  cycles.  An  event  cycle 
is  basically  a  series  of  related  steps  within  a  program  that 
are  held  together  by  significant  beginning  and  end  points. 
Generally  accepted  auditing  standards  usually  segment  event 
cycles  into  the  following  categories:  sales  and  collections, 
acquisition  and  payment,  payroll  and  personnel,  inventory 
and  warehousing  and  capital  acquisition  and  repayment.  Most 
programs  have  many  event  cycles  and  each  event  cycle 
represents  an  area  that  should  be  examined  for  internal 
controls.  An  example  of  an  event  cycle  for  administration 
would  be  a  payroll  department.  The  cycle  begins  with  proper 
author  uation  of  employment,  pay  computed  using  only  valid 
time  cards,  proper  withholding  of  taxes,  segregation  of 
duties  for  personnel  processing  checks  and  those 
distributing  them.  Another  example  of  an  event  cycle  within 
an  activity  publishing  directives  would  include  gathering 
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information,  writing  a  draft,  transcribing  editing 
circulating  for  comments,  revising,  transcribing  in  final 
format,  publishing,  distributing  and  updating.  Once  all  the 
events  for  a  particular  program  are  identified,  a 
determination  is  made  as  to  their  vulnerability  to  risk.  The 
source  of  information  for  this  is  the  results  of  the 
vulnerability  assessments.  The  judgment  of  the  person 
performing  the  review  can  also  be  used.  It  is  important  to 
maintain  all  documentat ion  relating  to  this  process  to 
provide  future  reviewers  with  an  audit  trail. 

2 .  Review  of  the  General  Control  Environment 

The  environment  in  which  the  event  cycle  operates 
has  a  major  impact  on  the  effectiveness  of  internal 
controls.  An  important  part  of  the  internal  management 
control  review  is  an  evaluation  of  the  general  control 
environment  listed  earlier.  Analysis  of  the  general  control 
environment  performed  for  the  vulnerability  assessment  can 
be  used  for  this  process  but  should  be  updated  or  modified 
as  required. 

3 .  Documentation  of  the  Event  Cycles 

The  reviewer  of  an  event  cycle  must  thoroughly 
understand  each  part  of  the  event  cycle.  This  understanding 
is  accomplished  through  completely  documenting  the  cycle. 
This  is  particularly  important  when  the  person  preparing  the 
documentation  is  not  the  reviewer.  The  documentat i on  can  be 
in  the  form  of  a  narrative  description  or  a  flowchart  with  a 


narrative  description.  Documenting  the  event  cycle  is 
accomplished  through  reviewing  past  documentation  and 
interviewing  personnel  involved  in  the  cycle.  The 
documentation  should  include  such  things  as  procedures 
followed/  interviewing  personnel  performing  the  procedures 
and  examining  the  forms  and  records  developed  and 
maintained.  Additionally,  the  reviewer  should  examine  the 
documentation  with  personnel  involved  in  the  cycle  to  ensure 
it  accurately  reflects  the  cycle  correctly.  Also  a  small 
number  of  transactions  may  be  traced  through  the  cycle.  Both 
of  these  procedures  will  ensure  the  documentation  and  the 
understanding  of  the  event  cycle  are  accurate. 

4 •  Evaluation  of  Interna  1  Management  Controls 

The  fourth  step  in  the  internal  management  control 
process  is  to  evaluate  the  event  cycle  by  using  the 
documentation.  This  evaluation  should  help  the  reviewer 
decide  if  the  internal  control  system  is  sufficient  to 
provide  reasonable  assurance  against  waste,  loss, 
unauthorized  use  or  misappropriation.  This  evaluation  can 
also  determine  whether  the  internal  control  system  meets  the 
requirements  of  the  Federal  Managers'  Financial  Integrity 
Act  and  OMB  Circular  A-123. 

The  manner  in  which  this  is  done  is  to  first 
ascertain  the  control  objectives  for  the  event  cycle.  If  the 
control  objectives  are  achieved,  the  potential  for  the 
occurrence  of  waste,  loss,  unauthorized  use  or 
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misappropriation  is  significantly  decreased.  Next, 
control  objectives  for  an  event  cycle  should  be  written. 
This  documentation  should  be  reviewed  to  determine  whether 
the  list  of  objectives  for  each  cycle  is  complete,  logical, 
and  relevant  to  the  event  cycle.  If  the  control  objectives 
are  not  adeguately  documented,  such  documentation  should 
be  developed  and  maintained  as  part  of  the  overall 

documentation  of  internal  controls.  Third,  the  relationship 
between  this,  the  prior  task,  and  the  inherent  risks  in  an 
event  cycle  cannot  be  overemphasized.  Control  objectives 
are  established  because  a  risk  of  loss  exists;  internal 
management  control  techniques  are  implemented  to  prevent  the 
specific  loss  from  occurring. 

Another  important  area  during  this  step  is  to 
identify  whether  there  are  any  internal  control  techniques 
that  are  excessive,  thereby  creating  inefficiencies  and 
unnecessary  costs. 

The  final  results  of  this  process  should  identify 
those  internal  controls  which  require  testing, the  absence  of 
controls  that  should  be  corrected,  control  objectives  for 
which  control  techniques  are  not  adequate  and  system 
corrections  that  must  be  made  and  control  techniques  that 
are  unnecessary  and  can  be  eliminated. 

5.  Test inq  of  Internal  Controls 

This  is  the  final  step  in  the  review  process  and  is 
used  to  evaluate  if  the  controls  are  functioning  as 
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required.  This  step  is  similar  to  an  auditor's  compliance 
test.  It  may  be  done  by  selecting  a  sample  of  transactions 
and  reviewing  the  documentation  for  those  transactions 
to  determine  compliance  with  the  related  internal  control. 
In  addition,  observing  the  controls  functioning  and 
interviewing  personnel  involved  can  be  extremely  useful. 
If  control  techniques  are  not  functioning  properly,  the 
reviewer  should  evaluate  if  there  is  a  compensating 
control.  The  reviewer  should  note  any  other  techniques  which 
might  also  compensate  for  the  control  in  question.  The 
review  should  provide  documentat i on  for  any  control 
weaknesses  that  were  uncovered  and  possible  corrective 
actions  for  the  weaknesses. 

6 .  Reporting  the  Results  of  Internal  Management  Control 

Reviews 

After  completing  the  internal  management  control 
reviews,  the  results  are  summarized  and  reported  on.  Two 
types  of  reports  are  prepared.  The  first  report  provides 
management  of  the  program  information  concerning  the 
internal  control  weaknesses  within  the  system  and  possible 
corrections.  The  first  report  includes  material  weaknesses 
in  internal  accounting  and  administrative  controls  and  a 
schedule  for  their  correction.  Also,  material  weaknesses 
identified  and  corrected  during  the  year  are  included  in  the 
first  report  as  accomplishments.  The  first  report  is 
basically  an  internal  document  to  be  used  by  the  individual 
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command  to  correct  any  identified  weaknesses.  Any 
recommendations  to  improve  the  efficiency  and  effectiveness 
of  the  program  should  be  included.  The  second  report 
contains  a  listing  identifying  material  weaknesses  in 
internal  accounting  and  administrat i ve  control  of 
significance  to  the  President  and  the  Congress,  and  gives 
the  agency  head  the  required  information  necessary  to 
support  the  agency  head's  statement.  The  second  report  must 
be  made  available  to  the  public  unless  there  is  an  area  of 
the  report  that  is  judged  to  be  classified. 

F.  SCHEDULING  AND  TAKING  CORRECTIVE  ACTIONS 

DOD  Directive  5010. 38A  requires  that  a  formal  follow-up 
system  be  established  to  record  and  track  internal 
management  control  deficiencies  from  any  source,  schedule 
corrective  actions  with  completion  dates,  and  provide 
assistance  for  the  development  of  plans  for  implementation 
of  the  corrections.  The  recommended  corrective  actions  of 
the  internal  control  reviews  should  be  reviewed  for  possible 
implementation  on  a  timely  basis  by  the  functional  area 
managers  .  Although  no  specific  penalties  are  levied  for  not 
taking  corrective  actions,  the  administrative  controls  of  an 
activity,  if  properly  functioning,  generally  have  an  effect 
on  employee  awareness  of  individual  responsibility  and 
provide  some  sort  of  assurance  that  the  failure  to  perform 
assigned  procedures  will  result  in  appropriate  disciplinary 
action. 
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G.  QUALITY  CONTROL 

OPNAVINST  5200. 25A  (ref.6:p.4)  requires  that  quality 

control  shall  be  exercised  at  all  levels  of  command  to 
ensure  that  the  objectives  of  this  program  are  achieved. 
Spec i f ica 1 ly ,  Navy  activities  are  required  to: 

1.  Ensure  internal  control  training  is  provided 

2.  Vulnerability  assessments  and  management  control 
reviews  are  performed  adequately 

3.  Required  reports  are  prepared  accurately  and 
submitted  on  time 

4.  Establish  a  formal  follow-up  system  for  monitoring 
actions  to  significant  and/or  systemic  weaknesses 

5.  Establish  a  system  of  testing  corrective  actions  to 
significant  and/or  systemic  weaknesses. 

H.  CONCLUSION 

The  process  of  evaluating  internal  control  systems  has 
been  explained  in  this  chapter.  Personnel  who  have  received 
training  in  internal  management  control  reviews  should  be 
able  to  implement  this  system.  However,  the  Navy  has  not 
been  completely  successful  in  implementing  this  process.  The 
implementation  problems  encountered  by  the  Navy  and  the 
solutions  the  Navy  has  come  up  with  to  solve  these  problems 
will  be  covered  in  the  next  chapters. 
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IV.  INTERNAL  CONTROL  PROGRAM  IN  THE  DEPARTMENT  OF  THE  NAVY 

A.  HISTORY  OF  THE  NAVY'S  INTERNAL  CONTROL  PROGRAM 

Once  the  OMB  Circular  A-123  and  DOD  guidelines  were 
issued,  it  was  up  to  the  DON  to  implement  an  internal 
control  program  of  their  own  to  satisfy  the  requirements  of 
the  FMFIA. 

The  Navy's  first  internal  control  instruction, 
SECNAVINST  5200.35,  I nter na 1  Control  in  the  Department  of 
the  Navy,  was  issued  on  29  July  1983.  This  instruction 
incorporated  the  original  versions  of  Circular  A-123  and  DOD 
guidance,  as  well  as  the  FMFIA  within  DON.  The  instruction 
also  established  the  Navy's  own  program  to  develop, 
maintain,  review  and  improve  internal  control  systems  to 
ensure  resources  are  efficiently  and  effectively  managed. 
In  addition,  procedures  for  vulnerability  assessments  and 
management  control  reviews  were  provided. 

The  initial  responsibility  for  implementing  the 
program  was  assigned  to  the  Office  of  the  Assistant 
Secretary  of  the  Navy  for  Financial  Management  (ASN  (FM)). 
One  problem  with  this  first  instruction  was  that  there  was 
no  central  focal  point  for  the  Chief  of  Naval  Operations' 
(CNO)  office  to  coordinate  subordinate  commands  inputs.  This 
led  to  some  confusion  by  Naval  activities  on  exactly  how  to 
implement  the  program  at  the  local  level  because  of  no 
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detailed  guidance  from  the  CNO  level.  In  fact,  it  was  not 
until  almost  two  years  later  in  1985,  at  the  insistence  of 
the  ASN(FM),  that  the  CNO  established  an  office  and  assigned 
responsibility  for  the  Navy's  internal  control  program.  The 
role  of  the  CNQ's  office  is  explained  below. 

The  SECNAVINST  was  updated  and  reissued  on  17  May  1985. 
This  revision  provided  updated  fundamental  policy  guidance 
and  the  basic  management  philosophy  of  the  DON  Internal 
Control  Program. 

The  CNO  and  the  ASN  (FM)  have  different  roles  with 
regard  to  the  program.  The  role  of  the  CNO's  office  is 
detailed  in  OPNAVINST  5200. 25A  (ref.6:p.5).  This  instruction 
was  issued  6  January  1986  and  assigns  responsibility  for  the 
Navy's  Internal  Control  Program  to  the  Assistant  Vice  Chief 
of  Naval  Operations  ( AVCNO )  (OP-09B).  The  AVCNO  provides  the 
ASN  (FM)  with  reports  and  statements  required  to  satisfy  the 
requirements  of  the  FMFIA.  The  AVCNO  is  also  responsible  for 
promulgating  field  guidance,  developing  procedures, 
establishing  reporting  requirements,  maintaining  an 
assessable  unit  inventory,  monitoring  compliance,  directing 
management  control  reviews,  following  up  on  specific 
weaknesses  assigning  responsibility  for  correction  of  Navy¬ 
wide  specific,  significant  and  systemic  weaknesses, 
evaluating  corrective  actions  and  coordinating  all  training 
requirements  relating  to  the  internal  control  program. 


43 


The  A3N  (FM)  role,  under  the  OEfice  of  the  Comptroller 
of  the  Navy  (NAVCOMPT),  is  really  twofold.  First,  NAVCOMPT 
is  responsible  for  the  maintenance  of  their  internal  control 
policy  instruction  on  internal  control  and  preparation  of 
NAVCOMPT  reports  based  on  input  from  NAVCOMPT  components  on 
the  status  of  the  Navy's  accounting  systems  internal 
controls.  More  importantly,  NAVCOMPT  is  responsible  for 
writing  the  Secretary  of  the  Navy's  annual  compliance 
statement  to  the  Secretary  of  Defense  by  consolidating  all 
upper  echelon  DON  commands  such  as  CNO,  Commandant  of  the 
Marine  Corps  and  all  the  Secretariat  level  offices'  annual 
compliance  statements.  In  preparing  the  Secretary  of  the 
Navy's  annual  statement,  NAVCOMPT  extracts  all  material 
weaknesses  that  have  Navy-wide  application  from  the 
individual  compliance  statements  they  receive. 


B.  FINANCIAL  ORGANIZATION  STRUCTURE  OF  THE  NAVY 

DON  is  a  large  decentralized  organization  that 
accomplishes  its  mission  through  the  use  of  a  chain  of 
command . 

The  financial  management  organization  structure  within 
DON  has  at  its  head  the  Assistant  Secretary  of  the  Navy  for 
Financial  Management  (ASN  (FM)).  The  ASN  (FM)  is  responsible 
for  all  matters  related  to  the  financial  management  of  the 
DON  including  budgeting,  accounting,  disbursing,  financing, 
progress  and  statistical  reporting  and  auditing.  Hence,  the 
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ASN  (FM)  is  the  Navy's  chief  of  accounting  information 


systems . 

The  DON  has  fourteen  major  accounting  systems  that  meet 
the  GAO  definition  of  adequate  accounting  systems. 
Currently,  only  one  of  these  systems  is  in  compliance  with 
the  DOD  Accounting  Manual  procedures.  For  example,  the 
Navy's  pay  and  disbursing  system  (JUMPS)  was  disapproved  by 
GAO  because  there  were  too  many  errors  in  the  system. 

The  Navy  recognizes  that  there  are  major  deficiencies  in 
its  accounting  systems.  However, the  Navy  does  have  a  plan  to 
bring  all  its  accounting  systems  into  substantial  compliance 
with  prescribed  OMB  and  Comptroller  General  principles  and 
standards.  This  plan  is  called  the  DON  Strategic  Financial 
Management  Master  Plan  and  details  the  systems,  deficiencies 
and  corrective  actions. 

Some  of  the  major  deficiencies  identified  in  the  Navy's 
accounting  systems  through  the  management  control  review 
process  include: 

1.  Data  inaccuracy  and  incompleteness 

2.  Information  does  not  meet  user  needs 

3.  System  is  not  under  full  general  ledger  control 

4.  Systems  do  not  have  adequate  internal  controls 

5.  Systems  are  inefficient,  labor  intensive  and  costly 

6.  Systems  do  not  have  adequate  audit  trails 

7.  There  is  no  uniform  chart  of  accounts 
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Each  of  these  deficiencies  cause  Navy  managers  problems 
in  trying  to  analyze  their  operations  and  deciding  how  to 
control,  conserve,  protect  and  use  their  resources. 

The  FMFIA  has  made  the  Navy  focus  on  getting  their 
accounting  systems  in  order  since  each  accounting  system 
must  be  reviewed  and  identified  deficiencies  corrected.  One 
of  the  major  reasons  the  Navy  felt  that  they  needed  to  get 
their  accounting  systems  in  order  are  the  possible 
consequences  of  reporting  the  accounting  systems  as 
deficient.  The  possible  consequences  or  penalties  of 
reporting  deficiences  are  the  budget  implications  and  strong 
managerial  leverage  that  can  be  applied.  There  have  been 
recent  efforts  to  reduce  the  Navy's  budget  because  of 
internal  control  weaknesses. 

C.  EFFECT  OF  THE  FEDERAL  MANAGER'S  FINANCIAL  INTEGRITY  ACT 

The  major  effect  of  the  FMFIA  on  the  DON  was  to  provide 
the  Navy  with  a  significant  impetus  to  improve  management 
control  and  accountability  by  focusing  attention  on  system 
problems.  To  this  end  the  FMFIA  has  shown  some  success  and 
the  Navy  has  demonstrated  a  commitment  to  strengthen  its 
systems . 

However,  the  initial  Navy  reaction  to  the  FMFIA  and  the 
internal  control  program  was  negative.  There  was  significant 
resistance  by  management  when  tasked  to  perform 
vulnerability  assessments  and  management  control  reviews.  A 
number  of  managers  felt  that  the  program  was  requiring  them 
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to  do  what  auditors  did,  in  that  managers  were  in  effect 
auditing  themselves.  This  negative  attitude  toward  the 
program  by  senior  line  managers  was  and  still  is  a  major 
stumbling  block  to  effective  implementation  of  the  program. 

The  positive  aspects  of  the  FMFIA  are  that  first,  the 
Navy  has  taken  action  to  establish  internal  control 

evaluation  procedures.  Within  the  last  two  years,  the  DON 
has  established  and  clarified  a  number  of  written  procedures 
to  guide  activities  in  implementing  a  satisfactory  internal 
control  program. 

Second,  the  Navy  has  identified  and  corrected  material 

weaknesses.  Some  of  these  weaknesses,  however,  are  long 

standing  problems  which  take  time  to  fully  correct,  and  the 
solutions  are  not  always  easy. 

Third,  as  a  result  of  the  FMFIA,  the  Navy  has  also 
identified  and  corrected  a  number  of  weaknesses,  which 

individually  are  not  considered  to  be  material  in  lost 
money,  time,  etc.  However,  these  weaknesses  usually  involved 
failure  to  comply  with  established  policies  and  procedures, 
and  collectively  are  important  since  failure  to  correct 
these  weaknesses  could  have  a  material  effect  if  all  items 
are  considered. 

D.  RESEARCH  METHODS 

The  information  gathering  for  this  thesis  included 
review  of  the  published  GAO  audits  and  other  studies, plus 
DOD  and  DON  instructions  relevant  to  the  internal  ccr.tr  1 


program.  In  addition  and  more  importantly,  a  telephone 
survey  was  conducted  which  asked  the  interviewees  what  k i nd 
of  implementation  problems  they  had  experienced  with  regard 
to  implementing  the  requirements  of  the  FMFIA  and  internal 
control  program  at  their  or gan  i  zat i ona 1  level. 

The  interviewees  consisted  of  personnel  from  the  Office 
of  the  Navy  Comptroller,  the  Navy  Accounting  and  Finance 
.'enter,  the  Chief  of  Naval  Operations,  the  Commander  i  n 
Chief,  U.S. Atlantic  Fleet,  the  Commander  Naval  Surface 
Force,  J.3.  Atlantic  Fleet,  the  Chief  of  Naval  Education  and 
Training  and  the  Naval  Audit  Service. 

These  commands  were  selected  because  each  of  them  has  a 
J.rect  impact  on  the  implementation  process  and  most  have 
subordinate  commands  to  whom  they  provide  internal  control 
guidance  . 

The  telephone  interviews  were  conducted  with  twelve 
.nd.v.duals  who  had  some  responsibility  for  the  internal 
control  program  at  these  activities.  The  procedure  used 
during  the  interviews  was  to  explore  the  history  of  the 
implementation  process  at  their  commands  and  then  ask  what 
specific  implementation  problems  they  had  experienced  with 
the  program.  Each  implementation  problem  identified  during 
the  interviews  was  then  further  investigated  to  determine 
whether  or  not  this  problem  appeared  to  be  a  Navy-wide 
problem.  The  interviewees  were  also  asked  what  solutions  to 
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their  implementation  problems  they  had  arrived  at  and  what 
improvements  they  would  recommend. 

E.  DON  INTERNAL  CONTROL  PROGRAM  IMPLEMENTATION  PROBLEMS 

The  internal  management  control  review  process 
previously  described  would  seem  to  be  a  relatively  simple 
process  that,  .t  followed  carefully,  would  produce  adequate 
results  and  satisfy  the  requirements  of  OMB  Circular  A-123 
and  the  FMFIA.  Nevertheless,  the  Navy  has  experienced 
numerous  implementation  problems  which  have  been  the  source 
of  tremendous  frustration  for  Navy  managers.  The  first  list 
of  identified  implementation  problems  are  derived  from 
published  GAO  reports  (ref.  7)  and  a  study  completed  by  the 
President's  Council  on  Management  Improvement  (ref.  8)  and 
i nc 1 ude  : 

1.  Paperwork  and  workload  burden 

2.  Inadequate  basis  for  reporting 

3.  Nl  follow-up  or  tracking  system  for  reporting 
corrected  internal  control  deficiencies 

4.  Accounting  systems  did  not  conform  to  GAO  requirements 
Each  of  these  areas  will  be  examined  more  closely. 

1 .  Paperwork  and  workload  burden 

The  President's  Council  on  Management  Improvement 
highlighted  the  paperwork  and  workload  burden  of  the  program 
in  their  October  1985  report  (ref.  8:p.l).  Two  of  the  major 
findings  from  thLS  report  were  that  :  1)  a  substantial  time 

c«nd  paper  burden  was  created  in  the  FMFIA's  implementation; 


and  2)  similar  vulnerability  assessment  results  could  have 
been  accomplished  through  a  simpler  process  with  less  paper. 

In  GAO's  December  1985  audit  of  the 
FMFIA  (re£.9:p.54)  GAO  wrote  that  a  common  concern 
surrounding  the  Act  has  centered  on  documentation  of  systems 
and  the  view  that  the  evaluation  process  has  become  a 
burdensome  paper  exercise.  Additionally,  the  House  Committee 
on  Government  Operations  expressed  concern  that  some  agency 
officials  believed  that  implementation  of  the  Act  had 
accomplished  little  beyond  adding  to  the  paperwork  burden. 
The  Committee  concluded  that  if  managers  adopt  the  view  that 
the  implementation  process  is  merely  a  burdensome  paper 
exercise,  this  attitude  will  hamper  efforts  to  achieve 
substantial  improvement  in  the  management  of  the  Federal 
Government . 

The  President's  Council  on  Management  Improvement 
report  found  that  the  vulnerability  assessment  process  was 
the  most  frequently  criticized  process.  They  found  that 
managers  believed  that  this  process  was  required  to  be 
performed  too  frequently.  In  addition,  some  managers  thought 
the  vulnerability  assessment  process  could  be  done  by 
relying  on  information  produced  from  existing  management 
control  evaluation  and  reporting  processes. 

Another  major  problem  is  staffing.  Although  the 
individual  managers  were  responsible  for  reviewing  their 
programs,  there  were  no  personnel  billets  identified  to 
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coordinate  the  command  programs  or  train  the  managers  on  the 
proper  procedures.  The  Internal  Control  Program  coordinators 
were  generally  found  in  the  internal  review  organization  or 
given  to  a  junior  officer  as  a  collateral  duty,  and  usually 
the  program  coordinators  had  no  knowledge  or  experience 
in  the  area  of  internal  control  systems. 

2 .  I nadequate  basis  for  report i no 

One  problem  the  Navy  has  encountered  during 
implementation  is  an  inadequate  basis  for  reporting  their 
internal  control  systems  as  being  in  compliance  with 
prescribed  standards.  The  Navy  did  not  know  how  general 
prescribed  standards  would  apply  to  their  operations  and 
their  systems  that  were  under  development.  The  GAO  audit 
(ref.  9 : p . 3  5 )  reported  that  agencies  did  not  know  if 
controls  were  adequate  because  their  internal  control 
programs  had  not  yet  evolved  to  the  point  that  they  provided 
an  adequate  basis  to  determine  that  the  Navy's  systems  of 
internal  controls,  taken  as  a  whole,  met  the  requirements  of 
the  Act.  In  addition,  there  had  been  difficulty  in 
identifying  systemic  internal  control  problems. 

3 .  No.  f  ol  low-up  or  tracking  s  ys  tern  for  report  i  ng 
corrected  internal  control  deficiencies 

Another  problem  area  noted  by  the  GAO  was  that  most 

Navy  activities  had  not  established  required  formal  tracking 

and  follow-up  systems  to  monitor  and  ensure  that  internal 

control  deficiencies  were  promptly  corrected.  GAO  stated 
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that  the  Navy  could  progress  significantly  in  its  future 
FMFIA  effort  by  implementing  the  required  tracking  and 
follow-up  systems  throughout  the  Navy  (ref.  7:p.22  ).  Two 
major  reasons  given  for  the  lack  of  a  system  were  no 
guidance  on  exactly  how  to  set  up  a  system  and  the  reporting 
requirements  under  the  system.  Given  the  quality  of  the 
initial  implementation  guidance,  these  reasons  appear  valid. 

4 .  Account i nq  systems  d id  not  conform  to  GAO 

requirements 

As  stated  earlier,  only  one  of  the  fourteen  Navy 
accounting  systems  is  in  compliance  with  DOD  Accounting 
Manual  procedures.  The  GAO  audit  on  the  Navy's 
implementation  progress  (ref.  7:p.6  )  stated  that  the  Navy 
did  not  evaluate  and  test  in  operation  any  of  their 
accounting  systems,  did  not  adequately  coordinate  internal 
control  reviews  with  accounting  system  evaluations,  and  had 
not  established  an  adequate  system  to  track  accounting 
system  deficiencies. 

F.  RESULTS  OF  INTERVIEWS 

The  specific  implementation  problems  listed  below  are 
derived  from  the  results  of  the  interviews  with  the  commands 


listed  above. 

and 

represent  the 

interpretations 

or 

perceptions  of 

the 

interviewees  on 

the  effect 

of 

the 

implementation 

problems  on  the  overall 

effectiveness 

of 

the 

internal  control  process.  The  major  implementation  problems 
identified  in  the  interviews  include: 
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1.  Decent ra 1 i za t ion  of  the  Navy 

2.  Manager’s  resistance  to  participate 

3.  Lack  o£  procedural  guidance 

4.  Definition  of  an  assessable  unit 

5.  No  standard  inventory  of  assessable  units 

6.  Vulnerability  assessments  less  than  required 

7.  Lack  of  manager  training 
3.  Paperwork  burden 

Each  of  these  areas  will  now  be  examined. 


1 .  Decentralization  o £  the  Navy 

The  Federal  Managers'  Financial  Integrity  Act 
process  is,  in  general,  a  very  cumbersome  process.  This  is 
particularly  a  major  problem  for  large  decentralized 
or gan i zat  ions  such  as  the  Navy.  The  paperwork  aspects  of  the 
program  are  compounded  by  the  need  to  promulgate  the  program 
down  through  the  Navy  chain  of  command  to  the  lowest 
managerial  level.  The  lowest  managerial  level  is  then 
required  to  complete  the  required  management  control  reviews 
in  a  short  time  frame  to  satisfy  the  reporting  requirements 
up  the  chain  of  command.  This  layering  effect  can  sometimes 
involve  five  or  more  levels,  which  can  slow  the  overall 
process  and  make  the  manager  on  the  bottom  of  the  chain  of 
command  sometimes  perform  his  work  in  a  crisis  mode. 

2 .  Manager ' s  res  istance  to  pa  r  t  i  c  i  pa  te 

With  the  introduction  of  any  new  system  to  an 
organization  there  will  always  be  some  internal  resistance 
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to  change  that  is  normal  human  reaction.  The  Navy  was  no 
exception  when  it  tried  to  implement  their  internal  control 
program.  Each  interview  conducted  referred  to  the  problem  of 
manager  resistance  to  participate  in  the  program.  There  were 
several  reasons  given  for  this  problem.  First  and  foremost, 
the  managers  believed  that  by  reporting  and  documenting 
their  internal  control  weaknesses,  they  were  in  effect 
putting  themselves  "on  report".  Managers  thought  that  the 
program  was  making  them  into  auditors.  Secondly,  managers 
believed  the  enormous  time  and  effort  imposed  in  completing 
the  process  was  not  well  spent  and  could  be  used  on  more 
productive  work.  Thirdly,  most  line  managers  viewed  this  as 
a  "staff"  problem  and,  therefore,  felt  that  they  did  not 
need  to  participate  because  they  believed  that  internal 
controls  only  applied  to  accounting  and  financial  controls 
and  not  administrative  controls.  Finally,  if  the  command's 
internal  control  program  coordinator  was  successful  in 
getting  the  organization's  managers  to  participate,  the 
sketchy  or  nonexistant  guidance  and  training  from  the 
headquarters  level  caused  a  lot  of  managers  to  call  the 
program  a  failure  before  it  had  a  chance  to  be  implemented. 

3  .  Lack  o f  procedural  guidance 

A  major  problem  for  the  Navy  was  that  procedural 
guidance  on  implementing  certain  areas  of  the  FMFIA  was 
inconsistent  and  overlapping.  Some  interviewees  believed 


that  the  entire  process  on  how  the  Navy  wanted  to  implement 
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the  program  was  not  completely  thought  out  prior  to  issuance 
o£  the  first  SECNAV  instruction.  In  addition,  the  Navy  had 
not  completely  resolved  who  was  going  to  be  involved  in  the 
reporting  cycle,  how  to  perform  vulnerability  assessments 
and  internal  management  control  reviews,  and  realistic 
training  program-  for  managers  were  not  ready.  This  led  to 
major  confusion  among  all  Navy  commands  because  no  one 
really  understood  the  entire  process.  Initial  guidance  was 
simply  a  distribution  of  the  OMB  guidelines  and  GAO 
standards  . 

4 .  Definition  of  an  assessable  unit 

The  major  problem  addressed  in  the  interviews  was 
that  there  was  not  a  consistent  definition  of  what  an 
assessable  unit  was  and  how  detailed  the  assessable  unit  had 
to  be.  This  problem  ties  back  into  the  problem  of  poor 
guidance.  Some  activities  segmented  their  organizations  into 
assessable  units  based  on  their  organization  charts  (e.g.. 
Supply,  Operations,  Administration,  etc.)  while  some 
segmented  these  into  smaller  units  (e.g.,  Supply  was 
segmented  into  purchasing,  receiving,  shipping  and 
d  isburs i ng ) . 

5 .  No  standard  inventory  o f  assessable  units 

This  is  a  follow-on  problem  from  the  above 
discussion.  The  point  here  is  that  because  the  Navy  had  no 
standard  inventory  of  assessable  units,  it  had  a  problem 
directing  which  areas  Navy  commands  should  review  on  a 
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systemic  basis,  because  some  commands  had  not  segmented 
their  commands  in  the  same  way  as  other  commands. 

6 .  Vulnerabi 1 itv  assessments  less  than  reou  ired 

The  GAO  audit  noted  that  agencies  have  devoted 
considerable  resources  to  making  vulnerability  assessments, 
and  the  vulnerability  o £  thousands  o£  operations  have  been 
assessed.  Nevertheless,  these  efforts  have  not  resulted  in 
reliable  and  useful  information  to  managers. 
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viewed  was  discussed.  A  major  problem  in  ^his  area 
t  managers  had  a  preconceived  judgment  over  what  the 
bility  of  a  program  should  be.  This  judgment  was  used 
of  the  process  discussed  earlier  to  identify  the 
s  already  in  place  that  could  reduce  the 

bility  of  that  area.  As  discussed  before, 
bility  assessments  are  to  be  a  preliminary  analysis 
manager  on  where  internal  control  strengths  and 
ses  may  exist  in  their  programs  and  on  the 

ibility  of  their  programs  to  fraud,  waste  or  abuse. 

Lack  of  manager  training 

All  interviewees  agreed  on  this  point.  If  the  entire 
1  control  process  is  to  work  and  the  requirements  of 
IA  are  to  be  met,  then  it  is  vital  that  all  managers 
training  in  the  internal  control  process. 
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Unfortunately,  there  was  a  poor  definition  of  what  training 
was  required  and,  therefore,  the  quality  of  training  was 
unsatisfactory.  Instructing  and  training  managers  must  be 
performed  to  provide  them  with  a  better  understanding  of 
what  was  required  of  them.  The  consensus  of  opinion  was  that 
if  all  the  managers  were  trained  in  the  process,  then  the 
reviews  and  reports  produced  would  be  of  higher  quality  and 
the  Navy  would  have  a  better  basis  for  reporting. 

8 .  Paperwork  burden 

Most  interviewees  had  some  comment  on  the  paperwork 
burden  of  the  program  as  it  related  to  manager  resistance  to 
the  program.  The  problem  pointed  out  in  the  interviews  was 
that  their  managers  had  a  firm  belief  that  the  entire 
internal  management  control  process  was  requiring  them  to 
spend  already  scarce  resources  documenting  a  lot  of 
information  that  they  did  not  feel  was  particularly  useful 
to  them.  Most  managers  felt  that  documenting  their  systems 
should  produce  information  that  could  assist  them  in 
developing  corrective  actions  and  planning  future  work.  The 
interviewees  noted  that  this  type  of  comment  from  managers 
was  common  and  generally  came  from  frustrated  managers  who 
had  resisted  the  program  from  the  outset. 

G.  CONCLUSION 

The  Navy  is  well  aware  of  all  of  the  problems  mentioned 
above.  Most  of  the  problems  identified  during  the 
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interviews  and  studies  result  from  the  fact  that  the  Navy's 
internal  control  program  has  not  yet  fully  evolved  into  an 
effective  program. 

Some  of  the  major  findings  included  in  this  chapter 
were  the  manager's  resistance  to  participate  in  the 


program,  the  paperwork  and  workload  burden,  lack  of  good 


procedural  guidance,  and  no  follow-up  system  for  internal 


control  deficiencies.  The  Navy  recognizes  that  several 


improvements  are  still  required  to  achieve  a  quality 


internal  control  program. 


The  next  chapter  will  describe  some  of  the  Navy's 


solutions  to  the  identified  implementation  problems. 
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V.  NAVY'S 


SOLUTIONS  TO  IMPLEMENTATION  PROBLEMS 


A.  INTRODUCTION 

The  GAO  audits  of  the  Navy's  implementation  of  the  FMFIA 
have  commented  on  the  Navy's  implementation  progress.  The 
GAO  noted  that  the  "Navy  had  made  progress  in  developing  and 
implementing  its  internal  control  evaluation  program  and  in 
reviewing  its  accounting  systems  for  conformance  with  the 
Comptroller  General's  requirements"  (ref.  7:p.2).  In 
addition,  "the  Navy  increased  its  organizational  and 
functional  coverage;  conducted  more  assessments  of  the  risks 
of  fraud,  waste,  and  abuse;  completed  an  inventory  of  its 
accounting  systems;  and  evaluated  two  major  accounting 
systems  and  two  subsystems"  (ref.  7:p.2). 

The  following  are  areas  in  which  the  Navy  has  made 
progress  in  correcting  implementation  problems.  The 
solutions  described  below  have  been  gathered  from  the 
interviews  with  major  Navy  commands. 

1.  Updating  internal  control  program  guidance 

2.  Using  other  sources  of  information  to  substitute 
for  Internal  Control  Reviews 

3.  Integrating  audit  plans  into  the  Management  Control 
review  process 

1.  Improving  manager  training 

5.  Writing  an  Internal  Control  Review  plan  based  on 
vulnerability  assessments 

6.  Internal  Control  Information  System 
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A  detailed  description  of  each  of  these  areas  is 
presented,  below. 

B.  NAVY'S  ACTIONS  TO  SOLVE  IMPLEMENTATION  PROBLEMS 
1 .  Improving  Internal  Control  Guidance 

NAVCOMPT  and  CNO  recognized  that  several 
improvements  were  needed  to  achieve  a  quality  program  and 
emphasized  consistent,  good  quality  management  control 
reviews,  particularly  documenting  the  control  process  and 
testing  control  techniques. 

NAVCOMPT  and  CNO  established  and  clarified  a  number 

of  written  procedures  to  guide  commands  and  activities  in 

implementing  a  satisfactory  internal  control  program.  Some 

of  these  changes  include  revising  the  vulnerability 

assessment  process  from  a  2  to  a  5  year  cycle  and  providing 

more  direction  on  specific  areas  to  review. 

2 •  Using  Other  Sources  of  Information  to  Subst i tute 
for  Internal  Control  Reviews 

A  substantial  portion  of  management's  resistance  to 
the  program  came  from  managers  who  believed  that  the 
management  control  review  process  was  duplicating  the 
efforts  of  inspection  and  audit  teams.  The  internal  control 
program  process  required  that  the  manager  review  his  areas 
of  responsibility  to  identify  weaknesses  and  document  the 
entire  process.  At  the  same  time,  the  same  manager  was 
being  audited  or  inspected  in  the  identical  area.  Most 
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managers  felt  that  this  was  a  tremendous  duplication  of 
effort  and  laid  the  blame  on  the  management  control  process. 

Recognizing  the  problem,  the  new  OPNAVINST  allows 
Navy  activities  to  use  other  management  control  activities 
such  as  management  studies,  audit  reports,  inspections  and 
reviews  to  assess  controls  and  substitute  these  for  internal 
management  control  reviews.  This  solution  was  implemented 
because  most  agencies  believe  that  audit  reports,  management 
studies  and  command  inspections  are  an  integral  part  of  an 
effective  management  control  system. 

3 .  I nteqrat ino  aud i t  o Ians  i nto  the  management  control 
review  process 

The  Naval  Audit  Service  has  a  number  of  functional 
area  audit  plans  that  are  used  by  auditors  when  auditing 
Naval  activities.  These  functional  area  audit  plans  serve  as 
general  guidelines  for  the  auditors  to  check  for  compliance 
with  directives  and  procedures.  The  audit  plans  do  not 
include  every  possible  area  that  can  be  reviewed  in  the 
functional  area,  but  are  the  minimum  effort  required  by  the 
auditor.  The  reason  for  this  is  because  the  Audit  Service 
wants  their  auditors  to  have  some  degree  of  flexibility  when 
reviewing  a  particular  area  to  investigate  additional  areas 
The  Navy  is  attempting  to  integrate  these  audit 
plans  into  the  management  control  review  process.  This  will 
allow  activity  managers  to  use  these  audit  plans  to  aid  them 
in  performing  their  internal  management  control  reviews. 
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The  Navy  hopes  that  each  activity  will  use  these 
audit  plans  as  a  baseline  to  possibly  develop  checklists  of 
their  own  that  can  be  tailored  to  specific  management 
control  problem  areas.  However,  there  are  pros  and  cons  to 
using  this  approach.  Checklists  are  a  management  tool  that 
can  be  used  effectively,  but  they  can  also  be  misused. 
Checklists  can  be  effective  in  ensuring  that  important 
review  areas  are  not  forgotten.  They  can  serve  as  a  reminder 
to  managers  that  they  need  to  ensure  adequate  review  is 
given  in  each  particular  area.  However,  usually  checklists 
are  not  all  inclusive.  Managers  have  a  tendency  to  review 
only  those  areas  that  are  included  on  the  checklist,  thereby 
potentially  missing  areas  that  need  closer  management 
review.  What  the  checklist  does  provide  is  a  point  of 
reference;  but  the  checklist  does  have  the  potential  for 
misuse  if  the  manager  relies  solely  on  the  checklist  to 
complete  his  management  control  reviews. 

4 .  Improving  Manager  Tra i n i ng 

Lack  of  or  no  training  for  the  manager  was  a  serious 
problem  the  Navy  needed  to  solve  if  the  program  was  to  be 
successful.  Two  areas  were  developed  by  the  Navy  as 
solutions  to  the  problem.  DOD  disseminated  a  self- 
instructional  course  on  conducting  internal  control  reviews. 
The  Navy  believes  that  when  this  course  is  combined  with 
better  headquarters  guidance  and  quality  assurance 
techniques  at  the  local  level,  it  will  achieve  the  desired 
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improvements  because  proper  training  will  afford  managers 
the  knowledge  required  to  perform  the  required  tasks  within 
the  program  and  hopefully  achieve  better  results.  Some 
interviewees,  however,  found  the  sel f - i ns tr uet i ona 1  course 
to  be  too  general  to  be  of  any  use. 

Probably  one  of  the  best  improvements  to  the  program 
is  the  internal  control  program  indoctrination  that 
prospective  Commanding  Officers  (PCO)  and  prospective 
Executive  Officers  (PXO)  receive. The  goal  is  to  indoctrinate 
as  many  PCOs  and  PXOs  as  possible  on  the  internal  control 
program  prior  to  reporting  to  their  new  assignments.  By 
making  these  officers  aware  of  the  internal  control  program 
and  the  importance  of  establishing  and  maintaining  an 
effective  internal  control  program,  it  is  hoped  that 
internal  controls  can  become  a  mindset  among  line  managers. 
Most  interviewees  believed  that  this  improvement  of 
increasing  the  consciousness  of  Navy  managers  to  internal 
controls  will  go  much  further  in  the  Navy's  effective 
implementation  of  the  program,  because  if  Commanding 
Officers  and  Executive  Officers  take  an  active  interest  in 
the  program,  it  can  be  successful. 

5 .  Writing  an  I nter  na 1  Control  Rev iew  Plan  Based  on 

Vulnerability  Assessments 

One  problem  area  previously  mentioned  was  that  the 
internal  control  reviews  were  sometimes  duplicating  the 
efforts  of  recently  completed  audits,  inspections  and  other 
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reviews.  To  solve  this  duplication  of  effort  problem,  the 
CNO,  in  conjunction  with  the  Naval  Audit  Service,  is  writing 
a  five  year  internal  control  review  plan  based  on  the 
results  of  the  Navy's  vulnerability  assessments.  This  five 
year  plan  will  be  meshed  with  the  Naval  Audit  Service's  five 
year  audit  plan  to  determine  which  areas  will  be  reviewed  by 
the  Naval  Audit  Service,  and  will  satisfy  the  requirement  of 
completing  a  management  control  review.  The  resulting  audit 
plan  and  internal  cuntrol  review  plan  will  be  reviewed  by 
the  AVCNO  and  the  Naval  Audit  Service,  and  will  be 
prioritized  based  upon  the  results  of  the  Navy's 
vulnerability  assessments.  Joint  approval  of  these  plans 
will  be  accomplished  by  both  activities.  This  is  a  change 
that  is  allowed  under  the  recent  revision  to  QMB  Circular 
A- 12 3 .  By  merging  the  internal  control  plan  and  audit  plan, 
the  Navy  hopes  there  will  be  a  reduction  in  the  duplication 
of  effort.  In  addition,  if  this  meshing  is  successful,  the 
Navy  believes  that  the  program  implementation  will  be 
improved  due  to  increased  functional  area  coverage,  a 
greater  number  of  assessments  can  be  conducted  and,  best  of 
all,  there  will  be  improved  identification  and  correction  of 
internal  control  weaknesses. 

6 .  I nter na 1  Control  Information  System 

The  Navy  has  developed  an  innovative  alternative  to 
the  traditional  approach  to  accounting  systems  evaluations. 
The  traditional  approach  is  weak  in  a  number  of  significant 
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areas.  First,  the  traditional  approach  has  often  failed  to 
encompass  the  entire  system  looking  only  at  individual 
segments  of  systems.  Second,  qualitative  measurements  of 
specific  threats  facing  a  system  and  the  resulting  risk 
reductions  achieved  by  individual  internal  controls  have  not 
been  obtained.  Lastly,  the  traditional  approach  has  not 
allowed  for  cost-benefit  analysis  of  the  merit  of  specific 
internal  controls. 

As  a  specific  action  to  overcome  these  shortcomings, 
NAVCOMPT  has  developed  the  Internal  Control  Information 
System  (ICIS)  (ref.  11).  The  ICIS  is  a  subset  of  NAVCOMPT's 
Consolidated  Systems  Evaluation  Program  (CSE).  CSE  is  a 
comprehensive  approach  to  accounting  systems  reviews  to 
determine  the  adequacy  of  an  accounting  system's  conformance 
to  regulations,  data  processing  soundness,  functional 
soundness,  and  internal  control  soundness. 

ICIS  is  a  computer /sof tware  supported  approach  to 
internal  control  review  and  improvement  which  addresses  each 
of  the  shortcomings  of  the  traditional  approach  to 
accounting  systems  evaluations.  The  ICIS  reviews  entire 
systems  instead  of  individual  segments  and  develops  and 
addresses  specific  threats,  associated  dollar  risks, and  risk 
reduction  achieved  by  individual  controls. 

ICIS  is  not  a  checklist  approach  to  internal  control 
evaluation.  It  is  an  approach  which  evaluates  the  threat  and 
potential  dollar  impact  in  each  area.  Expected  threat 


occurrence  rates  are  determined  and  all  controls  and  their 
risk  reduction  are  computed.  This  procedure  produces  a 
listing  which  shows  initial  exposure,  risk  reduction 
achieved  by  specific  controls  and  the  remaining  risk  after 
all  controls  ate  considered.  This  allows  the  manager  to  look 
at  each  control  with  regard  to  its  cos t -bene f i t .  In 
addition,  the  ICIS  allows  managers  to  use  sensitivity 
analysis  to  explore  the  impact  of  adding,  deleting  or 
modifying  internal  controls. 

Finally,  the  ICIS  appears  to  be  an  efficient, 
innovative  approach  to  accounting  systems  reviews.  It  is 
certainly  a  step  in  the  right  direction, and  it  is  hoped  that 
this  system  will  prove  to  be  effective  in  improving  reviews 
of  internal  controls  in  the  Navy's  accounting  systems. 

C.  OTHER  IMPROVEMENTS 

Two  other  improvements  deserve  mention  here.  The 
President’s  Council  on  Management  Improvement's  report 
identified  the  following  two  areas  of  potential  improvement 
to  the  implementation  process.  The  Council  looked  across 
different  government  agencies  to  see  what  they  were  doing  in 
relation  to  accomplishing  the  requirements  of  the  FMFIA.  The 
Navy  is  working  on  the  following  two  areas. 

1 .  De ve lop i ng  a  Short  Form  for  Management  Contr  o 1 

Reviews 

The  Department  of  the  Army  has  developed  a  checklist 
approach  to  the  internal  management  control  review.  The  Army 
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moved  in  this  direction  because  of  the  extensive  amount  of 
Army  regulations  (not  unlike  the  Navy)  that  specify  how 
functions  should  be  performed  so  more  standard ization 
was  needed.  This  was  accomplished  by  adjusting 
responsibility  for  internal  controls  around  functional 
managers  and  by  moving  to  a  standard  checklist. 

The  checklists  include  identification  of  the  task 
under  review,  the  associated  risk,  control  objectives,  and 
control  techniques.  The  checklists  are  designed  to  aid  the 
operating  managers  in  determining  if  internal  controls  are 
operating  properly  within  their  area  of  responsibility. 
Operating  managers  use  the  checklists  to  test  internal 
controls  and  provide  feedback  and  suggestions  to  functional 
managers . 

One  interviewee  stated  that  the  Navy  has  done  some 
preliminary  work  in  this  area,  but  development  of  the  Navy 
checklists  has  been  slow  because  of  the  nature  of  the  Navy's 
internal  control  reviews  are  so  diverse.  Designing  a  concise 
checklist  has  been  difficult.  Some  commands  were  trying  to 
develop  local  checklists  tailored  to  their  specific 
commands.  Further  investigation  by  the  Navy  into  developing 
management  control  review  checklists  appears  warranted, 
since  it  can  be  shown  that  when  correctly  used  these 
checklists  can  reduce  the  paperwork  burden  previously 
discussed . 
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2 .  Us  L ng  a  New  Vulnerabi 1 i ty  Assessment  Form 

Another  area  noted  by  the  President's  Council  was  a 
vulnerability  assessment  short  form  adopted  by  the  Federal 
Highway  Administration.  The  Navy  has  modified  this  form  for 
use  within  the  DON.  This  form  provides  the  manager  with  a 
concise  one  page  checklist  designed  to  provide  a  review  of 
the  general  control  environment,  analysis  of  inherent  risk 
and  a  preliminary  assessment  of  safeguards.  Some 
interviewees  believe  that  the  implementation  of  this  new 
form  will  be  very  useful  to  managers  because  it  will  allow 
managers  to  reduce  the  time  and  paperwork  required  to 
perform  vulnerability  assessments. 

D.  SHORTCOMINGS  OF  THE  NAVY’S  ACTIONS 

The  Navy  has  made  some  progress  in  implementing  the 
FMFIA.  The  Navy's  efforts  to  develop  and  improve  its 
internal  control  evaluation  program,  albeit  slow,  have 
proven  to  be  relatively  successful.  Nevertheless,  there  are 
still  some  shortcomings  in  the  Navy's  program. 

First,  the  Navy  has  spent  an  inordinate  amount  of  time 
identifying  and  documenting  internal  control  weaknesses  and, 
in  most  cases,  planning  and  taking  corrective  actions. 
However,  the  Navy  has  not  routinely  tested  the  corrective 
actions  of  the  internal  controls  to  verify  that  these 
corrective  actions  are  being  systematically  implemented  and 
the  controls  are  now  operating  as  intended.  The  Navy  needs 
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to  ensure  routine  testing  o£  corrective  actions  to  determine 
their  effectiveness. 

Another  shortcoming  of  the  implementation  process  is 
that  internal  control  awareness  in  the  Navy  has  not 
completely  filtered  down  to  all  applicable  management 
levels.  The  impression  received  throughout  the  interviews 
was  that  many  of  the  subordinate  commands  had  not  fully 
implemented  their  own  internal  control  programs.  To 
completely  implement  a  totally  effective  internal  control 
program,  the  Navy  must  ensure  that  internal  control  systems 
are  implemented  at  all  Naval  activities  to  provide  the  means 
for  preventing  fraud,  waste,  and  abuse.  The  best  way  to 
achieve  this  abjective  is  to  make  internal  controls  a 
mindset  among  Navy  managers.  This  requires  that  the  internal 
control  program  evolve  to  be  part  of  the  management 
organization  of  the  Navy. 

The  Navy  needs  to  find  a  way  to  give  the  line  managers 
more  incentive  to  implement  and  maintain  effective  internal 
control  systems.  The  line  manager  must  be  convinced  that 
effective  internal  control  systems  are  of  greater  benefit 
to  him  than  weak  controls.  The  benefits  must  be  explained 
to  him  in  terms  that  he  can  understand.  For  example,  if  the 
line  manager  can  be  shown  that  lack  of  a  specific  control 
is  draining  his  resources  and  requiring  him  to  forego 
meeting  mission  requirements  (such  as  less  ship  underway 
time  or  flight  hours,  or  not  enough  warfare  training 
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exercises  to  enable  his  crew  to  become  more  battle 
prof  icier.t ) ,  then  effective  internal  control  systems  can 
potentially  be  implemented  and  line  managers  will  begin 
to  associate  good  internal  control  systems  with  increased 
readiness.  This  effort  will  continue  to  be  a  major  challenge 
for  top  Navy  management,  because  getting  this  type  of 
incentive  across  to  all  Navy  managers  is  difficult  due  to 
the  decentralized  nature  of  the  Navy's  organization. 

Another  shortcoming  noted  is  that  the  Navy  needs  to 
concentrate  on  the  results  of  the  program.  Strengthening 
internal  controls  and  accounting  systems  is  the  bottom  line 
of  the  FMF1A.  The  Navy  needs  to  concentrate  more  on  the 
substance  of  the  evaluation  process  and  less  on 
documentat i on  and  report  language  to  achieve  the  overall 
objective  of  improving  internal  controls  and  accounting 
systems . 

Finally,  the  Navy's  organization  needs  to  investigate 
how  it  can  ensure  the  overall  effectiveness  of  its  internal 
control  program.  In  the  private  sector  the  approach  used  is 
the  formal  audit  committee.  This  committee  oversees  the 
various  audits  to  ensure  the  overall  effectiveness  of  the 
audits  the  particular  company  receives.  The  members  are 
independent  of  management.  This  is  important  because  it 
relieves  management  of  any  pressure,  perceived  or  otherwise, 
which  may  impact  on  the  effectiveness  of  the  particular 
audit.  The  Navy  may  investigate  use  of  an  inter -d isc  ipl i nary 
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body  apart  from  NAVCOMPT  and  AVCNO  to  integrate  the  various 
internal  control  concepts  and  definitions  and  to  develop  a 
common  reference  point.  This  body's  guidance  would  move  to 
develop  a  standard  against  which  other  activities  can  judge 
the  effectiveness  of  their  internal  control  programs,  and 
thus  help  other  Naval  activities  improve  their  internal 
control  systems.  This  oversight  committee  could  be  charged 
with  overseeing  the  financial  reporting  process  and  the 
Navy's  internal  control  system.  It  could  also  independently 
ensure  that  the  Navy  was  making  satisfactory  progress  toward 
improving  systemic  internal  control  weaknesses  and  further 
enhance  the  Navy’s  ability  to  report  their  accounting 
systems  and  internal  controls  in  compliance  with  the  FMFIA. 

E.  CONCLUSION 

The  Navy  is  working  to  strengthen  its  internal 
management  control  program.  While  progress  has  been  made  by 
the  Navy  to  correct  some  of  the  implementation  deficiencies 
and  smooth  out  the  rough  edges,  there  is  still  a  lot  of  work 
that  the  Navy  needs  to  do  before  it  has  an  efie...  .vh 
internal  management  control  program  and  more  importantly  a 
system  of  internal  controls  that  will  meet  the  inter. t  and 
the  requirements  of  the  FMFIA. 

The  last  chapter  provides  a  summary  along  with  some 
re  comine  ndat  ions  and  conclusions  on  what  additional  actions 
the  Navy  could  possibly  undertake  to  make  further  progress 
in  the  implementation  of  the  Act. 
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VI .  CONCLUSIONS  AND  RECOMMENDATIONS 


A.  SUMMARY 

The  purpose  of  this  thesis  was  to  determine  whether  the 
Navy  has  successfully  implemented  the  Federal  Managers' 
Financial  Integrity  Act  of  1982;  to  determine  if  the  Navy 
has  resolved  their  implementation  problems,  and  if  the  Navy 
has  come  up  with  any  innovative  ideas  to  make  the  management 
control  process  more  efficient  and  effective. 

This  thesis  consolidates  and  highlights  information  on 
the  Navy's  implementation  problems  and  their  efforts  to 
improve  their  internal  control  problems.  After  the  initial 
historical  background  of  internal  control  program 
development  in  the  Federal  Government,  an  explanation  of  the 
current  internal  control  evaluation  system  was  covered.  This 
chapter  was  presented  to  give  the  reader  an  apprec  i'at  i  on  of 
the  depth  of  information  and  workload  required  by  the 
current  internal  control  process. 

The  history  of  the  Navy's  Internal  Control  Program,  the 
Navy's  financial  management  structure  and  accounting  systems 
weaknesses,  and  the  implementation  problems  the  Navy  has 
experienced  in  implementing  their  internal  control  program 
was  then  developed  and  discussed.  The  information  in  this 
chapter  was  designed  to  show  the  reader  the  historical 
difficulties  encountered  by  the  Navy  in  organizing  their 
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program,  the  type  of  or gan i zat i ona 1  structure  the  Navy 
operates-  under  and  present  the  implementation  problems 
encountered  by  the  Navy  in  detail. 

The  Navy's  solutions  to  the  implementation  problems  and 
the  shortcomings  of  those  solutions  were  then  covered  in 
detail.  The  reader  should  hopefully  obtain  from  this  chapter 
an  appreciation  of  the  Navy's  efforts  in  correcting  their 
implementation  problems.  Additionally,  it  should  be  apparent 
to  the  reader  how  much  further  the  Navy's  program  needs  to 
evolve  before  it  can  be  judged  as  being  completely 
entrenched  in  the  Navy's  organization. 

The  genera  1 i zat  1  on  of  the  results  of  this  study  are 
limited,  given  that  only  a  few  activities  were  able  to  be 
interviewed.  Nevertheless,  since  the  activities  interviewed 
were  senior  Navy  echelon  commands,  the  results  of  this  stud;, 
could  be  extended  to  other  Naval  activities. 

B.  CONCLUSIONS 

Based  on  the  research  conducted  for  this  thesis,  one 
conclusion  reached  was  that  the  concept  of  internal  control 
in  the  Navy  has  progressed  significantly  over  time  since  the 
program’s  inception.  It  has  grown  from  merely  a  means  tj 
detect  and  prevent  fraud  to  include  the  means  of  effectively 
performing  a  mission  or  realizing  an  objective. 

The  FMFIA  process  has  produced  a  heightened  awareness  : 
the  importance  of  internal  controls  at  all  management  le.e._- 
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and  has  reiterated  management's  responsibility  for 
establishing  and  testing  those  controls. 

The  Navy's  efforts  to  fully  implement  the  FMFIA  are  far 
from  complete.  Although  the  basic  framework  for  an  effective 
internal  control  program  has  been  established  within  the 
Navy,  the  research  conducted  indicates  further 
implementation  must  be  done  before  the  Navy's  program  can 
provide  an  adequate  basis  for  determining  that  internal 
controls,  taken  as  a  whole,  comply  with  the  objectives  of 
the  Act.  The  Navy  has  recognized  the  deficiencies  in  the 
implementation  process  and  has  moved  to  correct  these  system 
deficiencies. 

In  my  opinion,  the  largest  obstacle  the  Navy  needs  to 
overcome  to  make  implementation  of  internal  controls 
successful  is  the  line  manager's  resistance,  to  participate 
in  the  program.  This  problem  is  compounded  by  the 
decentral ized  nature  of  the  Navy's  organ  i  zat 1  on  .  As  stated 
oefore,  the  Navy's  internal  control  program  needs  to  evolve 
to  be  part  of  the  management  organization.  How  is  the  Navy 
to  achieve  this  evolution?  My  opinion  is  that  the  Navy 
needs  to  go  back  to  basics  and  have  managers  assess 
themselves  by  looking  at  what  they  are  assigned  to  do, 
evaluate  the  results  against  whether  or  not  they  are  doing 
it,  and  if  there  is  a  difference  between  the  two,  then  take 
the  appropriate  corrective  actions.  Giving  the  line  manager 


more  incentive  to  have  strong  internal  control  systems  is 
also  extremely  important. 

Unfortunately,  this  simplistic  solution  will  only  work 
where  the  Navy  already  has  good  managers  in  place. 
Implementation  of  effective  internal  control  programs  has 
not  been  a  major  problem  where  good  managers  existed.  Where 
poor  managers  exist,  internal  control  programs  will  tend  not 
to  be  successful.  If  this  is  the  case  then  increased 
scrutiny  over  these  poor  managers  will  be  required  to  ensure 
the  objectives  of  the  internal  control  program  are  achieved. 

Other  implementation  problems  and  solutions  are 
procedural  in  nature  and  the  solutions  will  eventually  make 
the  Navy's  internal  control  program  more  effective. 

C.  RECOMMENDATIONS 

What  will  be  the  future  of  the  Navy's  internal  control, 
program?  Although  a  number  of  Navy  managers  probably  thought 
that  this  was  just  another  bureaucratic  program  that  would 
die  away,  my  view  is  that  the  Navy's  internal  control 
program  with  the  backing  of  the  FMFIA  is  here  to  stay.  The 
future  of  a  successful  program,  however,  will  depend  or  a 
number  of  factors  that  have  been  previously  discussed.  Since 
the  program  is  not  going  away,  it  is  in  the  best  interest  of 
the  Navy  to  make  the  program  work  for  the  Navy  and  improve 
its  internal  controls  and  accounting  systems  instead  of 
making  the  Navy  work  for  the  program. 
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The  following  actions  are  recommended: 

1.  The  Navy  needs  to  continue  to  incorporate  the 
internal  management  control  process  into  the  overall 
management  process.  This  would  result  in  greater 
support  fur  the  internal  control  process  and  would 
relieve  duplication  of  reviews  and  tracking  systems. 

2.  The  Navy  should  consider  reducing  the  paperwork 

burden,  and  reduce  staff  days  required  to  maintain  the 
process  by  further  developing  checklists  to  help 
managers  perform  internal  control  reviews.  These 

checklists  should  include  the  minimum  essential 
controls  needed  to  comply  with  the  internal  control 
standards.  These  checklists  would  serve  to  reduce  the 
program  down  to  a  simple,  manageable  level. 

3.  The  Navy  needs  to  continue  to  gain  the  support  of. 
senior  line  managers  in  relation  to  the  internal 
control  process  through  incentives  in  terms  the  line 
manager  can  relate  to.  This  is  a  critical  area  because 
without  these  senior  manager's  support  the  internal 
control  process  will  not  succeed.  The  Navy's  efforts 
in  indoctrinating  PCOs  and  PXOs  will  make  this  much 
easier  . 

4.  The  Navy  needs  to  continue  its  efforts  to  implement  an 
effective  tracking  and  follow-up  system.  Such  system^ 
are  essential  to  monitor  and  ensure  that  actions 
developed  to  correct  internal  control  deficiencies  a  r 
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completed.  The  Navy  needs  to  establish  a  central  are-j 
such  as  the  AVCNO  tor  reporting  correction  status  or 
weaknesses  and  streamline  follow-up  for  all  identified 
weaknesses . 

As  a  related  recommendation,  the  Navy  could  establish 
an  improved  implementation  feedback  program.  This, 
along  with  a  system  of  lessons  learned,  could  ensure 
that  implementation  problems  are  identified  tor 
evaluation  and  serve  as  a  guide  for  managers  to 
determine  the  actual  status  of  their  implementation 
process . 

To  fully  implement  an  effective  internal  control 
program,  the  Navy  needs  to  develop  more  effective 
manager  training  which  supports  the  program  and  gives 
a  set  of  guidelines  for  the  establishment  and  review^ 
of  internal  controls. 

The  Navy  needs  to  continue  to  focus  on  alternative 
ways  to  complete  the  management  control  review  process 
which  ace  most  cos t - be ne f 1 c 1  a  1 .  The  Navy  has  moved 
closer  in  this  direction  by  now  allowing  the  use  of 
audits,  inspections  and  other  reviews  to  serve  the 
purpose  of  management,  control  reviews. 

As  a  long  range  goal,  the  Navy  snouxd  study  the 
feasibility  of  establishing  a  computer  network  for 
reporting  requirements  of  the  Act.  Automating  h  r. - 
documentation  of  vulnerability  assessments  and 
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management  control  reviews  could  go  a  long  way  toward 
implementing  recommendations  4  and  5. 

9.  The  Navy  needs  to  investigate  the  use  of  an 
oversight  committee,  possibly  including  outsiders,  to 
integrate  internal  control  concepts  and  definitions 
and  to  develop  a  common  reference  point.  This  body 
could  help  ensure  the  Navy  was  making  satisfactory 
progress  toward  improving  internal  control  weaknesses 
and  enhance  the  Navy’s  ability  to  meet  the 

requirements  of  the  FMFIA. 
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